Oracle PeopleSoft PeopleTools CVE-2026-87355

Requires an attacker to already hold a low-privileged authenticated account on PeopleSoft Enterprise PeopleTools (PR:L) and to reach the Panel Processor component over HTTP. Exploitation is gated by two significant limiting factors: high attack complexity (AC:H), and mandatory interaction from a separate victim user (UI:R) who must view or act on the attacker-influenced panel content - it is not exploitable by an unauthenticated attacker and not against a passive system with no user activity. Limited to affected versions 8.61 through 8.63; the scope change (S:C) means successful exploitation can impact products beyond PeopleTools.

This is a medium-severity issue (CVSS 3.1 base 4.4) that in practice ranks as a low real-world priority. The vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N stacks multiple mitigating factors: exploitation is network-reachable over HTTP but is explicitly 'difficult to exploit' (AC:H), requires an existing low-privileged authenticated account (PR:L), and depends on interaction from a victim user other than the attacker (UI:R). The impact is limited - partial confidentiality and integrity, no availability impact - though the scope change (S:C) means successful attacks can reach beyond PeopleTools into additional products, which is why the score is not lower. No exploitation-probability signal is available: EPSS is not provided, the CVE is not on CISA KEV, and no public POC is identified, so there is no public exploit identified at time of analysis. The combination of high complexity, required privileges, and required user interaction makes opportunistic or automated mass exploitation unlikely. Note a data conflict: the input carries an 'Authentication Bypass' tag, but the description (authenticated low-privileged attacker, user-interaction-dependent, limited read/write) is inconsistent with an authentication bypass and is far more consistent with a stored/reflected cross-site-scripting-style flaw - verify the vulnerability class with Oracle before treating it as an auth bypass.

A low-privileged but authenticated PeopleTools user injects crafted content that is processed by the Panel Processor component. When a higher-privileged victim user subsequently views the affected panel, the payload executes in that victim's authenticated context, allowing limited unauthorized reads and unauthorized update/insert/delete of some PeopleTools-accessible data, with effects crossing into additional products (scope change). No public exploit is identified, and the high attack complexity plus required victim interaction make reliable exploitation non-trivial.