PeopleSoft PeopleTools EUVD-2026-106263

Exploitation requires the attacker to have access to the physical/local communication segment attached to the hardware running PeopleSoft Enterprise PeopleTools (Adjacent network, AV:A) - it is NOT remotely reachable across routed networks or the internet by default. It additionally requires meeting race or protocol-state conditions outside the attacker's control (AC:H, Oracle-rated 'Difficult to exploit'). No authentication is required (PR:N) and no user interaction is needed (UI:N). Affected deployments are limited to PeopleTools versions 8.61 through 8.63 using the WebLogic component. The adjacency requirement and high complexity are the primary limiting factors reducing realistic risk.

This is a low-to-moderate priority issue despite being unauthenticated, and the CVSS base score of 4.2 (MEDIUM) accurately reflects constrained real-world risk. The CVSS vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N shows the key limiting factors clearly: although no privileges are required (PR:N), the attack vector is Adjacent (AV:A) - the attacker must have access to the physical communication segment attached to the hardware running PeopleTools - and attack complexity is High (AC:H), meaning conditions outside the attacker's control must be met, consistent with Oracle's 'Difficult to exploit' characterization. Impact is limited to partial Confidentiality and partial Integrity (C:L/I:L) with no Availability impact (A:N). No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit was identified, so this is not confirmed to be actively exploited and is not internet-reachable by default. The only notable conflict is the 'Authentication Bypass' tag, which is not supported by the description - the description describes adjacent-network compromise yielding partial read/write data access, not a bypass of an authentication control - so that tag should be treated with skepticism and verified against the Oracle advisory. Net assessment: patch during the normal Oracle Critical Patch Update cycle; the adjacency and high-complexity requirements make opportunistic mass exploitation unlikely.

An attacker positioned on the same physical/local network segment as a PeopleSoft Enterprise PeopleTools server (e.g., a malicious insider or an actor who has already gained a foothold on an adjacent host) manipulates or intercepts WebLogic-component traffic to that host. By winning the specific race or protocol-state condition implied by the High attack complexity, they gain unauthorized read of a subset of PeopleTools data and unauthorized insert/update/delete on some accessible data. No public exploit code was identified at the time of analysis, so any attack would require custom development.