PeopleSoft PeopleTools EUVD-2026-105839

Requires a valid low-privileged PeopleSoft account (CVSS PR:L) with network HTTP access to the Report Distribution component of PeopleSoft Enterprise PeopleTools, on affected versions 8.61 through 8.63. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the need for pre-existing authenticated credentials is the primary limiting factor - this is not exploitable by a fully unauthenticated attacker, and impact is confined to read access to a subset of data.

This is a moderate-severity, low-real-risk issue by current signals. The CVSS 3.1 base score is 4.3 (MEDIUM) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - network-reachable over HTTP and low attack complexity, but it requires an existing low-privileged authenticated account (PR:L) and yields only limited confidentiality impact (C:L), with no integrity or availability effect and no scope change. No EPSS probability, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation; the realistic outcome is unauthorized read access to a subset of PeopleTools data, not full compromise. One conflicting signal must be flagged: the input Tags include 'Authentication Bypass,' which contradicts the CVSS vector (PR:L requires valid credentials) and the confidentiality-only information-disclosure impact - this is almost certainly a mislabeled tag and should not drive prioritization. Overall this is a legitimate patch-in-normal-cycle item rather than an emergency, best remediated via the Oracle October 2026 Critical Patch Update.

An attacker who already holds a low-privileged PeopleSoft account sends crafted HTTP requests to the Report Distribution component and reads a subset of PeopleTools data they should not be able to access. No public exploit code was identified at the time of analysis, and the low complexity means a valid-but-unprivileged user could trigger it directly without additional tooling.