Oracle PeopleTools EUVD-2026-106272

The attacker must have access to the physical communication segment attached to the hardware running PeopleSoft Enterprise PeopleTools (adjacent-network positioning, AV:A) and must overcome high attack complexity (AC:H), indicating conditions outside the attacker's direct control such as specific message timing or state. Affected deployments are limited to PeopleTools versions 8.61 and 8.62 in the Search Framework component. No authentication (PR:N) and no user interaction (UI:N) are required once adjacency is achieved. Limiting factors that reduce real-world risk: the mandatory local/adjacent network foothold (not routable from the internet), the high-complexity precondition, and the confidentiality-only impact (no write or denial-of-service capability).

This is a moderate-severity, hard-to-exploit confidentiality issue, not an urgent priority despite the 'Authentication Bypass' tag. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.3) is the dominant signal: while no authentication is required (PR:N) and no user interaction is needed (UI:N), exploitation requires adjacent-network positioning (AV:A - the attacker must sit on the physical communication segment attached to the host) AND high attack complexity (AC:H), which together sharply constrain real-world exploitability. Impact is confined to confidentiality (C:H, I:N, A:N) - data disclosure only, no integrity or availability loss. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active or probable exploitation; the signals are internally consistent in pointing to a low-likelihood, moderate-impact issue rather than a high-risk flaw. One conflict worth flagging: the 'Authentication Bypass' tag is hard to reconcile with a PR:N adjacent-network confidentiality-disclosure vector (there is no privileged state to bypass when none is required), suggesting the tag may be inaccurate - verify the actual mechanism with Oracle. Prioritize patching in the normal quarterly Critical Patch Update cycle rather than as an emergency.

An attacker who has gained a foothold on the same local/physical network segment as the PeopleSoft Enterprise PeopleTools host passively or actively manipulates Search Framework communications to read critical application data in transit or at the service boundary. No credentials or user interaction are needed, but the attacker must already be adjacent to the target and overcome high-complexity conditions (e.g., timing, specific message states). No public exploit code was identified in the provided data.