Oracle PeopleSoft PeopleTools CVE-2026-91505

Exploitation requires the attacker to already hold high-privileged credentials and local logon access to the infrastructure on which PeopleSoft Enterprise PeopleTools (versions 8.61 or 8.62) executes, specifically abusing the Porting component. No user interaction is needed (UI:N). The key LIMITING factors are: the local attack vector (AV:L) rules out remote/network exploitation, and the PR:H requirement means the attacker must already be a privileged user - making this an insider-abuse or post-compromise escalation-of-impact scenario rather than an externally reachable vulnerability. The affected versions (8.61, 8.62) are narrow, further limiting exposure.

This is a moderate-severity (CVSS 3.1 6.0), locally-exploitable flaw in Oracle PeopleSoft Enterprise PeopleTools (Porting component). The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) is the dominant and essentially only hard signal available: exploitation requires local logon access to the infrastructure running PeopleTools AND already-high privileges (PR:H), which sharply constrains the realistic attacker population to insiders or an adversary who has already compromised a privileged account. There is no EPSS score, no CISA KEV listing, and no public POC referenced - exploitation status is therefore 'no public exploit identified at time of analysis.' Despite C:H and I:H (full read and modify of accessible data), the AV:L + PR:H combination means this is NOT a drive-by remote threat and should be prioritized well below internet-facing or unauthenticated issues. Note a conflict: the input Tags include 'Authentication Bypass,' yet the description and CVSS explicitly require a high-privileged authenticated attacker - these are contradictory and the 'Authentication Bypass' characterization appears mislabeled; treat auth-bypass framing with skepticism and verify against the Oracle CPU advisory. No SSVC data was provided.

A malicious insider or an attacker who has already obtained a high-privileged account on the server hosting PeopleSoft Enterprise PeopleTools logs in locally and abuses the Porting component to read and tamper with critical application data. Because the attack is local and requires high privileges with no user interaction (AV:L/PR:H/UI:N), it is realistically an insider-abuse or post-compromise privilege-leveraging scenario rather than a remote exploit. No public exploit code is identified at the time of analysis.