PeopleSoft Enterprise PeopleTools EUVD-2026-105902

Exploitation requires (1) a valid low-privileged authenticated account on PeopleSoft Enterprise PeopleTools (PR:L - the attacker must be a logged-in user), and (2) interaction from a different victim user who must render or open the attacker-supplied content (UI:R), targeting the Fluid Core component on versions 8.61-8.63. The scope change (S:C) indicates successful payload execution can affect products beyond PeopleTools itself. Limiting factors that reduce real-world risk: the mandatory second-party victim interaction, the need for prior authentication (no anonymous/default-config exploitation), and the restriction to the specific affected version band.

This is a medium-severity (CVSS 3.1 base 5.4) issue in Oracle PeopleSoft Enterprise PeopleTools Fluid Core. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N describes a network-reachable, low-complexity flaw that nonetheless requires an authenticated low-privileged account (PR:L) AND human interaction from a victim other than the attacker (UI:R), with a scope change (S:C) and partial confidentiality/integrity impact but no availability impact. The combination of UI:R + S:C + C:L/I:L + A:N is the canonical fingerprint of a cross-site-scripting-style flaw, where an authenticated attacker injects content that executes in another user's browser/session, which is why 'attacks may significantly impact additional products.' No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so real-world exploitation probability cannot be quantified from the available signals. Weighing these signals: the dual precondition of attacker authentication plus victim interaction meaningfully lowers practical risk versus a raw remote-unauthenticated RCE, so this is a moderate-priority patch (bundled in the Oracle October 2026 CPU) rather than an emergency. Note the input 'Authentication Bypass' tag conflicts with the CVSS vector, which explicitly requires privileges (PR:L) and does not describe an authentication-defeat primitive - treat that tag as suspect.

A low-privileged but authenticated PeopleSoft user injects a crafted payload into a Fluid Core field or request that is later rendered to a higher-privileged user (e.g., an administrator or HR operator). When that victim views the content, the payload executes in their authenticated session, allowing the attacker to read a subset of and modify some PeopleTools-accessible data, with effects crossing into additional products (scope change). No public exploit was identified at time of analysis, and successful exploitation hinges on the required victim interaction.