PeopleSoft PeopleTools EUVD-2026-105906

Exploitation targets the Fluid Core component of PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 over HTTP. No attacker authentication is required (PR:N), but successful attack REQUIRES human interaction from a victim other than the attacker (UI:R) - typically a legitimate user opening a crafted link or loading attacker-supplied content in their session - which is the primary limiting factor. The scope change (S:C) means the impact extends beyond the vulnerable PeopleTools component into the victim's authenticated context/other products. Impact is bounded: only low-level read and limited insert/update/delete on a subset of PeopleTools-accessible data, with no availability impact. Realistic risk is highest for internet-facing PeopleSoft portals with active user populations susceptible to phishing.

This is a moderate-severity (CVSS 6.1) vulnerability whose CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is the textbook signature of a cross-site scripting / content-injection flaw rather than the 'Authentication Bypass' implied by the input tag: network reachable, low complexity, no privileges, but requiring user interaction, with a scope change and only low confidentiality and integrity impact and no availability impact. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation - the only signal is Oracle's own CPU disclosure. The headline PR:N makes it look like a trivial remote hit, but the mandatory UI:R (a victim must click a crafted link or load attacker content) materially limits real-world risk and makes this suited to targeted phishing/social-engineering rather than mass automated exploitation. Net: a genuine but not top-priority issue for most defenders - patch in the normal Oracle CPU cycle and prioritize internet-exposed PeopleSoft portals. Note the conflict to resolve with the vendor: the 'Authentication Bypass' tag is inconsistent with the UI:R / low-C/low-I / scope-change vector, which reads as XSS.

An attacker crafts a malicious URL or payload targeting the PeopleTools Fluid Core interface and delivers it to an authenticated PeopleSoft user via phishing or a planted link. When the victim opens it in their authenticated session, attacker-controlled script executes in the application context (scope change), allowing limited unauthorized reads and unauthorized insert/update/delete of some PeopleTools-accessible data. No public exploit code is identified in the provided data.