PeopleSoft PeopleTools EUVD-2026-105850

Exploitation requires network access to an HTTP-facing PeopleSoft Enterprise PeopleTools instance running an affected version (8.61-8.63); no attacker authentication is needed (PR:N). The key LIMITING factor is mandatory human interaction from a person other than the attacker (UI:R) - a legitimate user must be induced to interact (e.g., open a crafted link or page), so this cannot be exploited fully autonomously against an idle server. Deployments not exposing the PeopleTools HTTP interface to attacker-reachable networks, or on versions outside 8.61-8.63, are not affected. Oracle labels the issue 'easily exploitable' once the interaction occurs.

This is a credible but second-tier priority. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H, base 7.6) describes a network, low-complexity, unauthenticated flaw whose highest impact is availability (A:H, complete DoS) with only limited confidentiality and integrity (C:L/I:L). The single most important mitigating signal is UI:R - Oracle explicitly states 'successful attacks require human interaction from a person other than the attacker,' so exploitation is not fully self-driven and typically requires luring a legitimate user (e.g., to open a crafted link/page). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or at-scale exploitation; per precision rules this is 'no public exploit identified at time of analysis.' There is no inherent conflict among the signals - they consistently point to a genuine remotely-reachable issue whose practical risk is tempered by the required user interaction and the fact that the dominant impact is denial of service rather than full compromise. CWE is 'N/A' and no root-cause detail is given, which limits confident assessment of exploitation mechanics.

An unauthenticated attacker crafts a malicious HTTP request or link targeting an internet-reachable PeopleSoft PeopleTools web/database-server endpoint and induces a legitimate authenticated or privileged user to interact with it. The interaction triggers the flaw, hanging or repeatedly crashing PeopleTools (complete DoS) and allowing limited unauthorized read and update/insert/delete access to a subset of PeopleTools data. No public exploit code was identified at the time of analysis.