PeopleSoft Enterprise PeopleTools EUVD-2026-105804

Exploitation targets the Portal component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 and requires the attacker to possess a valid low-privilege PeopleSoft account (PR:L) with network HTTP access to the Portal - it is NOT remote-unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once a low-privilege foothold exists, exploitation is straightforward. Limiting factors: the requirement for authentication, and that only versions 8.61-8.63 are affected; realistic risk is highest where the Portal is internet-exposed and low-privilege/self-service accounts are widely provisioned.

This is a genuinely notable but not top-tier priority. CVSS 3.1 scores it 7.1 (High) with vector AV:N/AC:L/PR:L/UI:N - network-reachable over HTTP, low attack complexity, no user interaction, but requiring low-level privileges (PR:L), meaning an attacker must already hold a valid, low-privilege PeopleSoft account. Impact is skewed toward confidentiality (C:H - 'unauthorized access to critical data or complete access to all accessible data') with only partial availability impact (A:L, partial DoS) and no integrity impact (I:N). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no current signal of active or imminent exploitation; the threat is latent rather than demonstrated. The Oracle-sourced description and CVSS vector are mutually consistent (both indicate network, low-privilege, easily exploitable). One conflict to flag: the input Tags include 'Authentication Bypass,' which contradicts the CVSS vector's PR:L (exploitation requires authentication, not a bypass) and the description's explicit 'low privileged attacker' - treat the authentication-bypass label as suspect and verify against Oracle's advisory. Overall: prioritize patching for internet-exposed or multi-tenant PeopleSoft portals where low-privilege accounts are broadly provisioned, but this is not a drop-everything unauthenticated RCE.

An attacker holding a low-privilege PeopleSoft account (e.g., a standard employee or self-service user) sends crafted HTTP requests to the PeopleTools Portal component and gains unauthorized read access to critical data across the application, well beyond their intended authorization scope. The same access can be used to trigger a partial denial of service against the Portal. No public exploit code or evidence of active exploitation was identified at time of analysis.