PeopleSoft PeopleTools EUVD-2026-105823

Exploitation requires the attacker to already possess high (administrative) privileges within Oracle PeopleSoft Enterprise PeopleTools and network access over HTTP to the Updates Change Assistant component; affected supported versions are 8.61 through 8.63. The dominant limiting factor is PR:H - this is not exploitable by an unauthenticated or low-privileged user, so the realistic attacker set is restricted to privileged insiders or adversaries who have already taken over a privileged account. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once privileged access exists the attack is straightforward.

This is a moderate-severity issue (CVSS 3.1 base 5.5) whose real-world risk is substantially constrained by its privilege requirement. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L shows network attack vector over HTTP with low complexity and no user interaction, but critically PR:H - the attacker must already hold high (administrative) privileges within PeopleTools. This confines the realistic threat to malicious insiders or adversaries who have already compromised a privileged account, so despite the AV:N 'network' label, the practical barrier to entry is high. No EPSS score, CISA KEV listing, or SSVC decision data was provided in the input, and no public exploit was identified at time of analysis - all signals that argue against imminent mass exploitation. There is no conflict between the CVSS vector and the description: both agree the attacker is 'high privileged' with network/HTTP access. Impact is skewed toward confidentiality (C:H - complete read access to PeopleTools data) with only a partial availability hit (A:L) and no integrity impact (I:N). Net assessment: a genuine but second-tier priority - meaningful for high-value PeopleSoft deployments and insider-threat models, but not a drop-everything network-exploitable flaw, since it cannot be triggered by an unauthenticated remote attacker.

An attacker who already holds high PeopleTools privileges (a rogue administrator, or an outsider who has compromised a privileged PeopleSoft account) sends a crafted HTTP request to the Updates Change Assistant component. This yields complete read access to all PeopleTools-accessible data and can additionally cause a partial denial of service of the application. No public proof-of-concept was identified at time of analysis, and low attack complexity (AC:L) means the technique is reliable once privileged access is obtained.