PeopleSoft PeopleTools CVE-2026-87352

Exploitation requires the attacker to already possess a valid low-privileged logon to the infrastructure (operating system/server) on which PeopleSoft Enterprise PeopleTools executes - this is local access (AV:L), not network-facing. The flaw is in the LDAP component and affects only PeopleTools versions 8.61 through 8.63. Limiting factors that reduce realistic risk: no remote/unauthenticated path (AV:L + PR:L), no user interaction is needed (UI:N) once local access is held, impact is partial (C:L/I:L, A:N), and exploitation is confined to the subset of PeopleTools-accessible data rather than full system compromise. The key barrier for defenders is that an attacker must first gain authenticated local access to the PeopleTools host.

This is a genuinely moderate-to-low real-world priority, not a high-severity emergency. The CVSS 3.1 base score of 4.4 (MEDIUM) is consistent with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N: exploitation requires LOCAL access (AV:L) - specifically an existing logon to the infrastructure where PeopleTools executes - plus low privileges (PR:L), and yields only partial confidentiality and integrity impact (C:L/I:L) with no availability impact (A:N). All signals point the same direction: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC is referenced, so there is no evidence of active or imminent exploitation. The one conflicting signal is the input tag 'Authentication Bypass', which contradicts the vector - a true auth bypass would not require PR:L (authenticated low-privileged access); this tag appears mislabeled and should not drive prioritization. Net assessment: patch within the normal Oracle CPU cycle rather than as an out-of-band emergency, since the local-access and low-privilege prerequisites substantially limit blast radius.

A low-privileged user who already has an authenticated logon to the server infrastructure running PeopleSoft Enterprise PeopleTools abuses the vulnerable LDAP component to read a subset of application-accessible data and to perform unauthorized insert, update, or delete operations on some PeopleTools data. No public exploit code is identified at time of analysis, and the local access requirement (AV:L) means this is not remotely triggerable over the network against an unauthenticated attacker.