PeopleSoft PeopleTools EUVD-2026-105837

Exploitation requires network reachability to the PeopleSoft Enterprise PeopleTools SQR (Structured Query Report) component over HTTP on an instance running an affected version (8.61 through 8.63); per AV:N/AC:L/PR:N/UI:N no authentication, user interaction, or non-default configuration is stated as required by Oracle. The practical limiting factor is exposure scope: PeopleTools web interfaces are frequently segmented behind VPNs, reverse proxies, or internal networks rather than directly internet-facing, so realistic risk depends heavily on whether the SQR/PIA endpoint is reachable by the attacker. Impact is limited to confidentiality (read access to PeopleTools-accessible data); it does not permit data modification or service disruption.

This is a credible operational priority rather than an inflated high-CVSS artifact. The vendor-supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) is internally consistent and describes the most exploitable class of flaw: network-reachable over HTTP, low complexity, no privileges, and no user interaction. Oracle's own description reinforces this, calling it 'easily exploitable' by an 'unauthenticated attacker with network access via HTTP.' The impact is confined to confidentiality (C:H, I:N, A:N) - i.e., unauthorized disclosure of or complete read access to PeopleTools data, not data tampering or denial of service - which is why the score caps at 7.5 (High) rather than Critical. No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, so there is NO evidence of active exploitation or weaponization at this time; the risk is driven by exploitability characteristics, not observed attacks. One signal conflict to verify: the input Tags label this 'Authentication Bypass,' but the CVSS vector and description describe an unauthenticated information-disclosure flaw (C:H only, I:N) reached without any authentication step - not a bypass of an existing auth control. Treat the technique label with caution and rely on Oracle's description. Overall: patch promptly given trivial exploitability and sensitive data exposure, but absence of KEV/EPSS/POC signals suggests no confirmed mass exploitation yet.

A remote, unauthenticated attacker sends a crafted HTTP request to an internet- or network-reachable PeopleTools SQR (Structured Query Report) endpoint on an affected 8.61-8.63 instance and retrieves sensitive report or application data without credentials. No public exploit code is identified at time of analysis, and the confidentiality-only impact means the attacker reads data rather than modifying it. Low attack complexity (AC:L) means no special timing, configuration, or race conditions are required.