PeopleSoft PeopleTools EUVD-2026-105840

Exploitation requires the attacker to already hold high privileges (PR:H) on PeopleSoft Enterprise PeopleTools and to reach the Report Distribution component over HTTP. It applies only to PeopleTools versions 8.61 through 8.63. Key limiting factors: high attack complexity (AC:H, described by Oracle as 'difficult to exploit') and the prerequisite of an existing privileged, authenticated account - this is not reachable by an anonymous remote attacker. The scope change (S:C) means a successful attack can significantly impact additional products beyond PeopleTools itself. No special non-default configuration is named in the description beyond use of the Report Distribution component.

This is a high-CVSS-context but genuinely moderate real-world-risk issue. The CVSS 3.1 base score is only 5.8 (Medium) despite the scope change (S:C) and high confidentiality impact (C:H), because exploitation is gated by two strong limiting factors in the vector: high attack complexity (AC:H, 'Difficult to exploit' per Oracle) and high privileges required (PR:H). Thus the attacker must already hold a privileged, authenticated position on PeopleSoft Enterprise PeopleTools before this flaw yields value. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation - the signals are internally consistent and all point toward low near-term exploitation likelihood. Note a conflicting metadata signal: the input Tags include 'Authentication Bypass,' which directly contradicts the CVSS PR:H requirement (an auth bypass would be PR:N) - treat the tag as suspect and rely on the vendor CVSS vector. Net: patch on normal Oracle CPU cadence; this is not an emergency, drop-everything priority absent new exploitation evidence.

An attacker who has already obtained high-privilege authenticated access to a PeopleSoft PeopleTools environment abuses the Report Distribution component over HTTP to read critical data beyond their authorization, with impact crossing into additional connected products (scope change). The attack is difficult to execute (AC:H) and requires that pre-existing privileged foothold. No public exploit code was identified at time of analysis.