PeopleSoft PeopleTools EUVD-2026-106270

Exploitation requires the attacker to already hold a valid low-privileged account on the PeopleSoft Enterprise PeopleTools instance (PR:L) with network/HTTP reachability to the Process Scheduler component. It additionally requires human interaction from a separate victim user (UI:R) - the attack does not fire autonomously; a different person must perform an action that triggers the attacker-supplied content. High attack complexity (AC:H) implies non-trivial conditions or timing/configuration dependencies beyond the attacker's control. Limiting factors that reduce realistic risk: mandatory prior authentication, dependence on a victim interaction, and the high-complexity requirement; only versions 8.61 and 8.62 are stated as affected. Impact is bounded to partial confidentiality and integrity (read a subset, and insert/update/delete some data) with no availability impact, though the scope change means a successful attack can extend to additional connected products beyond PeopleTools itself.

This is a low-to-moderate priority issue despite being network-accessible. The CVSS 3.1 base score is 4.4 (Medium), and the vector (AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) tells a consistent story of a hard-to-exploit vulnerability: although reachable over HTTP, it requires high attack complexity (AC:H), existing low-level privileges/authentication (PR:L), and victim interaction from a person other than the attacker (UI:R). The scope change (S:C) combined with UI:R and low-only confidentiality/integrity impact (C:L/I:L, A:N) is characteristic of a stored/reflected cross-site-scripting-style or injection flaw where the attacker's payload executes in a victim's authenticated context and can reach beyond the PeopleTools boundary. No EPSS score, CISA KEV listing, or public POC was supplied in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. All exploitation signals point to a difficult, multi-condition attack rather than a mass-exploitable one; prioritize during the normal Oracle CPU patch cycle rather than as an emergency. Note one metadata conflict: the input tag 'Authentication Bypass' does not match the CVSS vector (which explicitly requires PR:L, i.e. an already-authenticated attacker) or the description, which never mentions bypassing authentication - treat that tag as suspect and verify against the Oracle CPU advisory.

A low-privileged authenticated PeopleSoft user plants a crafted payload through the Process Scheduler component. When a higher-value user (e.g. an administrator or another operator) later interacts with the affected interface, the payload executes in that victim's session, yielding limited unauthorized read plus insert/update/delete access to PeopleTools data and, because of the scope change, potential impact on additional connected products. No public exploit code is known, and the high attack complexity means reliable exploitation requires specific conditions and a cooperating victim action.