PeopleSoft PeopleTools CVE-2026-87353

Exploitation requires the attacker to first have logon access to the infrastructure/host where PeopleSoft Enterprise PeopleTools executes (AV:L - not remotely reachable over the network), and additionally requires human interaction from a person other than the attacker (UI:R), such as an operator or user performing a triggering action. Attack complexity is high (AC:H), meaning success depends on conditions the attacker cannot fully control. Affected scope is limited to PeopleTools versions 8.61-8.63 via the Porting component; the description names no specific feature-enable or configuration toggle, so the condition is the local-access-plus-victim-interaction prerequisite itself. These factors (local access, high complexity, required third-party interaction, partial impacts) substantially limit realistic exploitation.

This is a low-to-moderate priority issue despite being Oracle-sourced. The CVSS 3.1 base score of 4.5 (MEDIUM) is driven down by a difficult exploitation profile: AV:L requires the attacker to already have logon access to the infrastructure where PeopleTools runs (not a remote network vector), AC:H indicates conditions outside the attacker's control, and UI:R requires interaction from a separate human victim. Although PR:N technically marks this unauthenticated, the AV:L constraint means the attacker must first obtain local access to the host - so the 'unauthenticated' qualifier is practically bounded by the prerequisite of infrastructure logon, as the description itself states. No EPSS score, CISA KEV listing, POC, or SSVC data was provided in the input; absence of these is consistent with the recently-published Oracle October 2026 CPU and signals no evidence of active exploitation. Impacts are all 'partial' (C:L/I:L/A:L - limited read, limited unauthorized update/insert/delete, and partial DoS). Net: the combination of local vector, high complexity, and required third-party user interaction makes mass or opportunistic exploitation unlikely; this is a patch-in-normal-cycle item rather than an emergency.

An attacker who has already obtained local logon access to a server hosting PeopleSoft Enterprise PeopleTools (versions 8.61-8.63) crafts malicious input or a file tied to the Porting component, then relies on a legitimate user or operator to perform an action that triggers it. Successful exploitation yields limited unauthorized read of a data subset, limited unauthorized modification of some data, and a partial denial of service. No public exploit identified at time of analysis, and the high attack complexity plus required human interaction make reliable exploitation difficult.