PeopleSoft PeopleTools CVE-2026-91519

Requires a valid low-privileged account on the target PeopleSoft Enterprise PeopleTools instance (PR:L) reachable over HTTP, with the Report Distribution component in use - the standard mechanism for distributing Process Scheduler report output. LIMITING FACTORS: the attacker must already authenticate (no anonymous/unauthenticated path per CVSS PR:L), only PeopleTools versions 8.61 through 8.63 are affected, and impact is confined to confidentiality (unauthorized read of critical data) with no integrity or availability effect. Internet-exposed portals that allow broad self-service logins materially increase exposure; internal-only instances limit the attacker population to insiders.

This is a moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity flaw requiring only low-privileged authentication (PR:L) and no user interaction, yielding high confidentiality impact but zero integrity or availability impact - a pure data-disclosure bug. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so there is no public exploitation signal: exploitation status is 'no public exploit identified at time of analysis.' CONFLICT TO NOTE: the input Tag 'Authentication Bypass' contradicts the CVSS PR:L metric, which explicitly requires the attacker to already hold valid low-level credentials - a genuine authentication bypass would imply PR:N. Treat the 'Authentication Bypass' tag as unverified; the authoritative Oracle/CVSS data describes an authenticated, privilege-holding attacker. Because the flaw requires an existing account on the PeopleSoft instance and yields only confidentiality loss, real-world risk is elevated for internet-exposed PeopleSoft portals with broad self-service user populations but lower for internal-only deployments. Verify EPSS and any emerging POC before final prioritization.

An attacker who holds a low-privileged PeopleSoft account (e.g., a self-service or guest-tier user) sends crafted HTTP requests to the Report Distribution component to read reports and data they are not authorized to see. No public exploit code is identified at time of analysis, and the attack needs no user interaction or elevated privileges, making it feasible against any internet-facing PeopleSoft portal that permits low-tier logins.