PeopleSoft PeopleTools CVE-2026-87409

Requires an authenticated low-privileged account on PeopleSoft Enterprise PeopleTools (PR:L) with network HTTP access to the nVision reporting component; affected builds are PeopleTools 8.61 through 8.63. Limiting factors: exploitation is not possible pre-authentication, so an existing valid account or credential compromise is a prerequisite, and only instances running the affected nVision component in these versions are exposed. No user interaction is needed (UI:N), and impact is limited to data disclosure (confidentiality only), not modification or disruption.

This is a moderate-severity, authenticated information-disclosure flaw rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) signals network-reachable, low-complexity exploitation but explicitly requires low-level privileges (PR:L) - so an attacker needs an existing authenticated foothold, which meaningfully lowers real-world risk versus a pre-auth bug. Impact is confined to confidentiality (C:H, I:N, A:N): data exposure only, no integrity or availability loss. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. CONFLICTING SIGNAL: the input Tags include 'Authentication Bypass,' which contradicts the CVSS PR:L requirement for authenticated access - Oracle's own vector indicates privileges are required, so the 'Authentication Bypass' characterization appears inaccurate and should be verified against the Oracle CPU advisory. Overall this is a credible but not urgent priority: patch in the normal Oracle quarterly cycle, prioritized for internet-exposed PeopleSoft instances with many low-privilege users.

A low-privileged but authenticated PeopleSoft user (or an attacker who has phished/obtained any valid low-tier account) sends crafted HTTP requests to the nVision reporting component and retrieves data they should not be able to access, up to all PeopleTools-accessible data. Because attack complexity is low and the vector is network-based, exploitation is straightforward once a foothold exists, though no public proof-of-concept is currently identified.