PeopleSoft Enterprise PeopleTools EUVD-2026-105842

Exploitation requires the attacker to already hold a high-privileged logon (PR:H) to the infrastructure/host where PeopleSoft Enterprise PeopleTools and its SQR reporting component execute - this is a local vector (AV:L), not remote network access. Additionally, successful attacks require human interaction from a person OTHER than the attacker (UI:R), meaning a separate legitimate user must perform a triggering action, and the flaw is explicitly 'difficult to exploit' (AC:H) with non-deterministic conditions. Limited to affected PeopleTools versions 8.61-8.63. These stacked prerequisites (privileged local access + second-user interaction + high complexity) sharply constrain realistic exploitation to privileged insiders or post-compromise scenarios, though the scope change (S:C) means successful attacks can impact additional products beyond PeopleTools itself.

This is a genuinely moderate-to-low priority issue despite its 6.9 CVSS, and the vector is the reason: AV:L/AC:H/PR:H/UI:R describes an attacker who already has high-privileged logon access to the host where PeopleTools runs, must win a high-complexity race or condition, AND needs a separate human to perform an action. Those four limiting metrics stack heavily against real-world exploitation. The only reason the score reaches 6.9 is the scope change (S:C) combined with high Integrity and Availability impact (C:N/I:H/A:H). No EPSS score, KEV listing, or POC was provided in the intelligence, so there is no evidence of active exploitation or available exploit code - exploitation status is 'no public exploit identified at time of analysis.' One consistency note: the 'Denial Of Service' tag aligns correctly with the A:H availability impact described (hang/repeatable crash), so there is no conflict between the tags and the CVSS vector. The practical risk is that of a privileged-insider / post-compromise escalation and data-tampering vector rather than a remotely exploitable mass-exposure bug.

A high-privileged user (or an attacker who has already gained privileged logon to the PeopleTools server) leverages a flaw in the SQR reporting component to tamper with or destroy critical PeopleSoft data and crash the service. Because exploitation requires UI:R, the attacker must also induce a separate legitimate user to take some triggering action, and the high attack complexity (AC:H) means conditions are not reliably reproducible. No public exploit code is reported, so this would be a bespoke attack by a privileged actor.