PeopleSoft Enterprise PeopleTools EUVD-2026-105838

Exploitation requires network reach to the HTTP interface of Oracle PeopleSoft Enterprise PeopleTools and a valid low-privileged account (PR:L) - it is NOT unauthenticated. The vulnerable surface is specifically the Report Distribution component, so an environment must expose and use PeopleTools report distribution over HTTP. Affected versions are limited to PeopleTools 8.61 through 8.63; deployments on other release branches are outside the stated scope. Limiting factors: the attacker needs working credentials (even if low-privilege), narrowing the realistic threat to insiders or attackers who have already obtained a foothold/account; no user interaction is required (UI:N) and attack complexity is low (AC:L), so once a credential is held, exploitation is straightforward.

This is a credible operational priority rather than a paper tiger, but short of top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) describes a network-reachable, low-complexity attack over HTTP requiring only low-privileged authentication (PR:L) and no user interaction - Oracle's own text calls it 'easily exploitable,' which aligns with AC:L. Impact is high on integrity (unauthorized create/delete/modify of all PeopleTools-accessible data) and high on availability (complete DoS), with no confidentiality impact (C:N). Signals are largely consistent but intelligence is thin: there is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so exploitation likelihood cannot be quantified and exploitation status must be treated as unproven. No SSVC decision data was provided. The one tension to verify: exploitation requires valid low-privilege credentials (PR:L), which tempers the 'network/unauthenticated-looking' AV:N - this is an authenticated-insider or credentialed-attacker scenario, not drive-by remote code execution. Net: patch on a normal-to-expedited cycle given high integrity/DoS impact and easy exploitability, but absent KEV/EPSS/POC signals there is no evidence of active mass exploitation.

A low-privileged but authenticated PeopleSoft user (or an attacker who has phished/obtained any valid low-level account) sends crafted HTTP requests to the Report Distribution component of PeopleTools. By abusing the flaw they tamper with or destroy report/distribution data across the environment and can force a complete, repeatable crash (full DoS) of PeopleTools. No public exploit code was identified in the provided data, so this is a plausible-but-unproven scenario rather than a demonstrated one.