PeopleSoft PeopleTools EUVD-2026-105843

Exploitation targets the Report Distribution component of PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 and requires NO authentication (PR:N) and network access over HTTP. The key limiting condition is mandatory human interaction (UI:R) from a person other than the attacker - a legitimate user must be induced to interact (e.g., open a crafted link or report), so the attack is not self-contained and depends on social engineering or an active victim. There is no confidentiality exposure (C:N); the realistic outcomes are data tampering/destruction (I:H) and a complete repeatable crash (A:H). Realistic risk is therefore gated by whether an attacker can reliably reach a PeopleTools instance and get a user to act, and by patch status under Oracle CPU October 2026.

This is a genuine high-priority vulnerability, though not a drop-everything emergency absent active-exploitation signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, base 8.1) describes a network-reachable, low-complexity flaw requiring no privileges, which is attractive to attackers. The single meaningful brake is UI:R - successful attacks require human interaction from a person other than the attacker, which lowers reliability compared to a fully automatable AV:N/UI:N bug. Impact is serious but asymmetric: high integrity impact (unauthorized creation, deletion, or modification of critical data) and high availability impact (complete, repeatable DoS), with NO confidentiality impact (C:N) - so this is a tampering/disruption risk, not a data-exfiltration risk. Key exploitation signals are MISSING from the provided data: no EPSS score, no CISA KEV listing, and no POC indicator were supplied, so exploitation probability cannot be quantified and there is no evidence of active exploitation or public exploit code. The 'Denial Of Service' tag aligns with the A:H metric but understates the equally serious I:H integrity impact. Treat as a high-priority patch item driven by the strong CVSS profile and unauthenticated network reach, tempered by the user-interaction requirement and the absence of any confirmed exploitation intelligence.

An unauthenticated attacker crafts a malicious request or link targeting the Report Distribution component of an internet- or intranet-reachable PeopleTools instance and lures a legitimate PeopleSoft user into triggering it. When the victim interacts, the flaw lets the attacker tamper with or destroy critical PeopleTools data and/or force a complete, repeatable crash (DoS) of the application. No public exploit identified at time of analysis, so this scenario is inferred from the CVSS vector rather than a demonstrated chain.