PeopleSoft Enterprise PeopleTools EUVD-2026-105866

Exploitation requires an unauthenticated attacker with network access over HTTP to Oracle PeopleSoft Enterprise PeopleTools (Integration Broker component), versions 8.61 through 8.63. The decisive limiting factor is mandatory human interaction from a person other than the attacker (UI:R): a legitimate user must open a crafted link or page / act on an attacker-supplied request before the flaw triggers - automated, interaction-free mass exploitation is not possible. No special server-side feature toggle or non-default configuration is named in the description beyond the Integration Broker being reachable over HTTP; impact is bounded to data confidentiality (HIGH) and limited integrity writes (LOW), with no availability impact.

This is a moderate-priority issue rather than a drop-everything emergency, and the signals are largely consistent. The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) describes a network-reachable, low-complexity, unauthenticated flaw whose severity is meaningfully capped by the mandatory user-interaction requirement (UI:R) and the limited integrity / zero availability impact - the real weight is the HIGH confidentiality impact (potential access to all PeopleTools-accessible data). No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no evidence of active or imminent exploitation; the flaw is vendor-reported (Oracle) and fixed in the October 2026 Critical Patch Update. The single material conflict is the 'Authentication Bypass' tag versus the CVSS vector: the vector already models the attacker as unauthenticated (PR:N) and the description depicts a user-interaction-driven data-disclosure flaw (consistent with reflected XSS / client-side or request-forgery against Integration Broker), not a bypass of an authentication control - treat the tag as suspect and verify against Oracle's advisory. No SSVC fields, EPSS, or CWE were provided, so automatability and exploitation maturity cannot be scored from the input and should be considered UNKNOWN.

An attacker crafts a malicious link or web page targeting a PeopleSoft Integration Broker endpoint and lures a legitimate user (UI:R - a person other than the attacker) into opening it over HTTP. Because exploitation requires no authentication and low complexity, the victim's interaction triggers the flaw, letting the attacker read sensitive PeopleTools-accessible data and perform limited unauthorized writes. No public exploit code was identified in the provided data, so this is a plausible scenario, not an observed attack.