PeopleSoft PeopleTools CVE-2026-91497

Exploitation targets the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 specifically, reachable over HTTP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special privileges are required against affected default-reachable PeopleTools deployments. The principal limiting factors are version scope (only 8.61-8.63 are listed as affected) and network exposure of the PeopleTools/Environment Management HTTP interface - deployments where this interface is not network-reachable (e.g., restricted to internal management segments) substantially reduce exposure. Impact is bounded to unauthorized insert/update/delete of a subset of PeopleTools-accessible data, with no confidentiality or availability effect.

Signals are mixed and skew toward moderate, not critical priority. The CVSS 3.1 base score is 5.3 (Medium) driven entirely by a partial integrity impact (I:L) with no confidentiality (C:N) or availability (A:N) effect; the vector (AV:N/AC:L/PR:N/UI:N) indicates easy, remote, unauthenticated, no-interaction access, which raises exploitability but the capped impact limits overall severity. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so exploitation likelihood cannot be elevated beyond the theoretical. This is a real-but-moderate issue: the unauthenticated network reach makes it attractive for opportunistic scanning once an exploit emerges, yet the integrity-only, partial impact (unauthorized update/insert/delete to 'some' accessible data) means it is not a full compromise. Note a conflict between the input Tags and the data: the 'Authentication Bypass' tag is not corroborated by the description, which describes unauthorized data modification by an already-unauthenticated attacker rather than a bypass of an authentication control - verify tag accuracy with Oracle's advisory. EPSS and exploitation status are absent, so prioritization should rely on the standard Oracle CPU patch cadence rather than emergency response.

A remote, unauthenticated attacker reaches an internet- or network-exposed PeopleSoft PeopleTools Environment Management (Updates) endpoint over HTTP and sends a crafted request that the component processes without proper authorization. Because AC is low and no user interaction or privileges are required, the attacker achieves unauthorized insert, update, or delete of a subset of PeopleTools-accessible data, corrupting environment/update management records. No public proof-of-concept is identified at time of analysis, so exploitation would currently require independent research.