PeopleSoft PeopleTools CVE-2026-87412

Exploitation requires the attacker to already possess a high-privileged, authenticated PeopleTools account (PR:H) and to send HTTP requests to the Report Distribution component of PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63. The limiting factors are significant: no anonymous or low-privileged access is sufficient, the impact is confined to unauthorized read access to a subset of accessible data (no write/integrity or availability impact), and only the specified versions running the Report Distribution feature are affected. These constraints sharply reduce realistic risk relative to the network attack vector.

This is a genuinely low-priority issue despite being network-reachable. The CVSS 3.1 base score is only 2.7, driven by the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N: while the attack vector is network (HTTP) and complexity is low, exploitation requires PR:H - a high-privileged, already-authenticated account - and yields only low-confidence impact (C:L) with no integrity or availability effect. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided; absence of these is consistent with a minor Oracle Critical Patch Update item rather than an urgent threat. A notable conflict exists in the metadata: the input Tags include 'Authentication Bypass,' but the CVSS vector and description ('high privileged attacker') explicitly require PR:H privileges and describe only unauthorized read of a data subset - this is the opposite of an authentication bypass and the tag appears mislabeled. Treat this as a low-urgency patch-during-normal-cycle item, not a drop-everything priority.

An attacker who already holds a high-privileged PeopleTools account sends crafted HTTP requests to the Report Distribution component and obtains read access to a subset of data they are not authorized to see. No public exploit code was identified, and the requirement for pre-existing high privileges plus the low-complexity but low-impact nature makes this most plausible as insider misuse or post-compromise reconnaissance rather than an external break-in.