PeopleSoft PeopleTools CVE-2026-87349

Exploitation requires the attacker to already have high-privilege logon access to the infrastructure/host where PeopleSoft Enterprise PeopleTools executes (AV:L, PR:H) - this is not remotely reachable over a network. It additionally requires human interaction from a person other than the attacker (UI:R), meaning a separate legitimate user or administrator must perform some action for the attack to succeed. Affected deployments are limited to PeopleTools versions 8.61 through 8.63 and the flaw is in the Security component. These prerequisites (local high-privilege access plus a second-party victim) substantially limit realistic exploitation to insider or post-compromise contexts.

This is a moderate-severity issue (CVSS 6.5) that is unlikely to be a top-priority, mass-exploitation threat despite its full Confidentiality/Integrity/Availability impact. The CVSS vector itself is the strongest constraint on real-world risk: AV:L means no remote network vector - the attacker must already have logon access to the infrastructure where PeopleTools runs; PR:H means the attacker must already hold high privileges; and UI:R means a separate human (not the attacker) must take some action for the attack to succeed. Those three gating factors together make opportunistic or automated exploitation implausible, even though AC:L indicates the attack is technically easy once prerequisites are met. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no signal of active or probable exploitation - consistent with the 'no public exploit identified' status. Note a tag/description tension: the input Tags include 'Information Disclosure,' but the Oracle description and CVSS (C:H/I:H/A:H) describe full 'takeover' of PeopleTools, which is broader than information disclosure - treat this as a complete-compromise issue, not merely a read-only data leak. Overall this reads as a genuine but privilege-and-interaction-gated flaw suited to insider-threat or post-compromise/lateral-movement scenarios rather than an internet-facing emergency.

A malicious or compromised insider who already holds high privileges on the host running PeopleSoft Enterprise PeopleTools stages a crafted artifact or action within the Security component, then relies on a separate, legitimate user or administrator to interact with it, triggering full takeover of PeopleTools. Because the attack is local (AV:L) and requires high privilege plus victim interaction, it fits post-foothold escalation or abuse-of-access scenarios rather than remote mass exploitation. No public proof-of-concept exploit was identified at the time of analysis.