PeopleSoft PeopleTools EUVD-2026-105904

Exploitation targets the Business Interlink component of PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63, reachable over HTTP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are required - Oracle explicitly describes it as 'easily exploitable.' The practical limiting factors are: the PeopleTools HTTP interface (and specifically the Business Interlink component) must be network-reachable to the attacker, and the deployment must run an affected version (8.61-8.63); versions outside this range and network-segmented/unexposed deployments are not exploitable. Impact is inherently bounded to reading a subset of accessible data and causing a partial, not full, denial of service.

Signals are moderate and internally consistent. The Oracle-provided CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, base 6.5) describes an easily exploitable, network-reachable (HTTP), unauthenticated (PR:N) flaw requiring no user interaction - meaning exploitation is technically low-barrier. However, impact is deliberately limited: only low confidentiality (read access to a SUBSET of data) and low availability (PARTIAL denial of service), with no integrity impact (I:N). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or probable exploitation - this is a patch-in-normal-cycle issue rather than an emergency. The description and CVSS agree (both indicate network/HTTP, unauthenticated), so there is no vector/description conflict to flag. Net: a genuine but medium-priority vulnerability - easy to exploit but low blast radius, and currently no exploitation signal to elevate it.

A remote, unauthenticated attacker sends crafted HTTP requests to an internet-facing or network-reachable PeopleSoft PeopleTools Business Interlink endpoint, requiring no credentials, no user interaction, and low attack complexity. The attacker reads a limited subset of PeopleTools-accessible data and/or degrades service availability (partial DoS). No public exploit code is identified at time of analysis, so any current attack would require attacker-developed tooling.