PeopleSoft PeopleTools EUVD-2026-105846

Exploitation requires the attacker to first have a logon to the infrastructure (the host/OS environment) where PeopleSoft Enterprise PeopleTools executes - this is a local attack vector (AV:L), not remote network access. The flaw resides specifically in the Test Framework component of PeopleTools versions 8.61 through 8.63. No application-level credentials (PR:N), no user interaction (UI:N), and no special non-default configuration are stated as required once local access is obtained. The primary limiting factor is the mandatory pre-existing local foothold on the PeopleTools server, which confines realistic exploitation to insiders or attackers who have already compromised the host; impact is limited to confidentiality (read access to critical data), with no integrity or availability effect.

This is a moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score is 6.2 (Medium), driven entirely by a high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N). Critically, the attack vector is LOCAL (AV:L), and Oracle's description confirms the attacker must already have 'logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes' - meaning this is NOT a remotely exploitable network flaw despite the PR:N metric. The combination of AV:L + PR:N is Oracle's standard convention for 'no application credentials required, but local/infrastructure logon needed,' which should be read as a meaningful limiting factor. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Signals are internally consistent (low complexity, local vector, confidentiality-only impact), but the PR:N metric conflicts with the description's requirement of infrastructure logon - this tension should be verified: effectively exploitation requires an attacker to already have a foothold on the host, which substantially reduces real-world urgency compared to the nominal 'easily exploitable' phrasing.

An attacker who has already obtained a local logon on the server where PeopleSoft PeopleTools runs (e.g., a low-privilege OS account or an insider) abuses the Test Framework component to read confidential application data they should not be able to access. No application-level authentication and no user interaction are required once local access exists; no public exploit code is currently known.