PeopleSoft PeopleTools CVE-2026-87415

Exploitation targets the Report Distribution component of PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 reachable over HTTP. No valid credentials are required (PR:N), but the attack is explicitly gated by two limiting factors: (1) required interaction from a victim user other than the attacker (UI:R) - meaning the attacker must induce a legitimate user to perform an action such as clicking a crafted link; and (2) high attack complexity (AC:H), which Oracle characterizes as 'difficult to exploit', implying conditions outside the attacker's control (e.g., timing, specific state, or non-trivial preconditions) must be met. Impact is limited to confidentiality (read access); there is no integrity or availability impact (I:N/A:N).

This is a moderate-severity confidentiality issue (vendor CVSS 3.1 base 5.3) whose real-world priority is tempered by two significant exploitation barriers encoded in the vector: AC:H (Oracle explicitly describes it as 'difficult to exploit') and UI:R (successful attacks require human interaction from a person other than the attacker). While the vector is network-reachable and unauthenticated (AV:N/PR:N), the combination of high attack complexity plus required user interaction means exploitation is not point-and-click. Impact is confidentiality-only but high (C:H/I:N/A:N) - successful attacks can yield unauthorized read access to all PeopleTools-accessible data. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or at-scale exploitation; this currently reads as a credible-but-not-urgent patch item rather than a drop-everything emergency. Note a tagging/description tension: the input Tags include 'Authentication Bypass', but the description and vector describe an unauthenticated data-disclosure requiring user interaction (C:H only, no integrity impact) rather than a classic authentication bypass - treat the 'Authentication Bypass' label with skepticism and verify against the Oracle CPU advisory. CWE is unclassified (N/A) in the input.

An unauthenticated attacker crafts a malicious link or request targeting the Report Distribution component and lures a legitimate PeopleSoft user (via phishing or a planted link) into interacting with it. Because the attack is difficult to execute (AC:H) and depends on that victim's action (UI:R), success is conditional, but a successful attack exposes sensitive report data and potentially all PeopleTools-accessible data to the attacker. No public exploit code has been identified at time of analysis.