PeopleSoft Enterprise PeopleTools EUVD-2026-106266

Exploitation targets the Query component of PeopleSoft Enterprise PeopleTools (versions 8.61 and 8.62) and requires the attacker to already hold HIGH privileges within the application (PR:H) and to reach it over HTTP (AV:N). Oracle explicitly classifies it as 'difficult to exploit' (AC:H), meaning success depends on conditions outside the attacker's direct control beyond merely sending a request. The key limiting factors are the pre-existing high-privilege authenticated access and the high attack complexity; there is no user-interaction requirement (UI:N) and scope is unchanged (S:U). These prerequisites confine realistic exploitation to trusted privileged users or an adversary who has already escalated to a high-privilege PeopleTools account.

This is a moderate-severity issue (CVSS 3.1 base 5.5) that signals are consistent in de-prioritizing relative to its CIA impact breadth. The CVSS vector (AV:N/AC:H/PR:H/UI:N) describes a network-reachable but difficult-to-exploit flaw that requires an attacker to already hold high privileges within PeopleSoft Enterprise PeopleTools, which substantially narrows the realistic threat population to authenticated, privileged insiders or an attacker who has already compromised a high-privilege account. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. Oracle rates the dominant impact as availability (A:H, complete DoS) with only partial confidentiality and integrity impact (C:L/I:L), so this is primarily a denial-of-service concern rather than a data-breach or RCE priority. Net assessment: a genuine issue to patch in Oracle's October 2026 CPU cycle, but the high-privilege prerequisite and high attack complexity make it low-to-moderate real-world priority rather than an emergency. Note the CWE is listed as N/A and no EPSS/SSVC data was supplied, so quantitative exploitation likelihood is unknown and this judgment rests on the CVSS vector and Oracle's description alone.

An attacker who already possesses high-privilege access to the PeopleSoft Query component sends a crafted request over HTTP that triggers a hang or repeatable crash, producing a complete denial of service while also allowing limited unauthorized read, update, insert, or delete of some PeopleTools-accessible data. The high attack complexity means the attacker must satisfy specific conditions beyond simply issuing the request, and no public proof-of-concept is known.