PeopleSoft Enterprise PeopleTools EUVD-2026-106271

Exploitation requires the attacker to already hold a HIGH-privileged PeopleSoft Enterprise PeopleTools account (CVSS PR:H) and network HTTP access to the application; no user interaction is needed (UI:N). The attack targets the Meta Data component. The principal limiting factor is the pre-existing high-privilege authentication requirement, which restricts realistic exploitation to trusted/privileged insiders or attackers who have already obtained privileged credentials; only supported versions 8.61 through 8.63 are affected.

This is a moderate-severity issue (CVSS 3.1 6.5) whose real-world priority is meaningfully constrained by its prerequisites. The Oracle-supplied vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H) states the attacker needs HIGH privileges (PR:H) and network HTTP access, with no user interaction. The high C and A impacts (full read of PeopleTools-accessible data plus a repeatable crash/complete DOS) are serious, but PR:H means the attacker must already hold a high-privileged PeopleTools account, which sharply narrows the threat to malicious insiders or adversaries who have already compromised a privileged account. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - consistent with a recently disclosed Oracle Critical Patch Update item. CONFLICT TO NOTE: the input Tag 'Authentication Bypass' directly contradicts the PR:H vector and the description, which describe a privileged (not unauthenticated) attacker - the tag appears mislabeled and should not be used to escalate urgency. Net: a real but not top-tier priority; patch on a normal CPU cadence, and prioritize higher only where privileged PeopleTools accounts are broadly held or weakly controlled.

An attacker who already possesses a high-privileged PeopleTools account (a malicious insider or someone who has compromised privileged credentials) sends a crafted HTTP request to the Meta Data component. The request lets them read critical PeopleTools-accessible data or trigger a repeatable crash causing a complete denial of service. No public exploit code is identified at time of analysis, and exploitation requires the pre-existing high-privilege access, limiting realistic attackers.