PeopleSoft PeopleTools EUVD-2026-105831

Exploitation requires an authenticated low-privileged account (PR:L) with network access over HTTP to the Analytic Server component of PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63. The high attack complexity (AC:H) indicates the attacker must meet additional conditions beyond their control - such as a specific server state, race condition, or configuration - making reliable exploitation difficult. Limiting factors: valid credentials are mandatory, the flaw only affects the Analytic Server module, and the maximum achievable outcome is a partial (not complete) denial of service with no confidentiality or integrity impact.

This is a genuinely low-priority vulnerability, and the signals are consistent rather than conflicting. The vendor-supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L, base 3.1 LOW) describes a network-reachable but hard-to-exploit flaw that requires existing low-level privileges and yields only a partial availability impact with zero confidentiality or integrity effect. No EPSS score, KEV listing, or public POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of high attack complexity (AC:H), required authentication (PR:L), and impact limited to partial DoS means that even a successful attack produces only a degraded, not destroyed, service. This is a low-real-risk issue that should be patched during routine Oracle CPU cycles rather than treated as an emergency. Note that EPSS is absent (not low - simply not provided), so probabilistic exploitation likelihood cannot be quantified from the available data.

An attacker who already holds a low-privileged authenticated account on a PeopleSoft Enterprise PeopleTools deployment sends specially crafted HTTP requests to the Analytic Server component. Due to the high attack complexity, the attacker must satisfy specific timing or state conditions to trigger the flaw, and success only degrades availability of PeopleTools rather than granting data access or code execution. No public exploit code is known to exist.