PeopleSoft PeopleTools CVE-2026-91468

Requires that the PeopleSoft Enterprise PeopleTools QAS (Query Access Services) component be reachable over HTTP from the attacker's network position; affected versions are specifically 8.61 through 8.63. No special configuration is cited by Oracle - exploitation works against standard deployments without authentication or user interaction (AV:N/AC:L/PR:N/UI:N). The primary limiting factors are version range (only 8.61-8.63) and network exposure of the QAS HTTP interface: instances where PeopleTools is not internet-facing or is placed behind authenticated gateways/WAF controls materially reduce real-world reachability. Impact is inherently partial - only a subset of data can be altered and only a partial DoS can be caused.

This is a moderate-priority vulnerability (CVSS 3.1 6.5, MEDIUM) whose signals are internally consistent but incomplete. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated flaw with no user interaction - Oracle's own description reinforces this as 'easily exploitable.' However, impact is deliberately bounded: C:N (no confidentiality loss), I:L (partial unauthorized update/insert/delete of SOME accessible data), and A:L (partial denial of service only), so this is not a full-system-compromise or data-theft bug. No EPSS score, SSVC decision, POC, or KEV listing was provided in the input, so exploitation likelihood cannot be quantified: exploitation status is therefore 'no public exploit identified at time of analysis.' There is no signal conflict - the network vector in CVSS aligns with the HTTP-based description. The main gap is the absence of probability/exploitation telemetry (EPSS/KEV), meaning prioritization should rest on exposure (is the QAS component internet-facing?) rather than on confirmed active-exploitation evidence. Treat as a routine-to-prompt patch item within the Oracle October 2026 CPU cycle rather than an emergency.

An unauthenticated attacker with network access to a PeopleSoft Enterprise PeopleTools instance (versions 8.61-8.63) sends a crafted HTTP request to the exposed QAS component. Because no authentication or user interaction is required and attack complexity is low, the attacker is able to perform unauthorized modification, insertion, or deletion of a subset of accessible data and to trigger a partial denial of service of the application. No public proof-of-concept was identified at the time of analysis.