PeopleSoft Enterprise PeopleTools EUVD-2026-106290

Requires a valid low-privileged account on the PeopleSoft Enterprise PeopleTools Portal component (PR:L - not unauthenticated) AND requires human interaction from a different user (UI:R), i.e. a victim must view or interact with the attacker-injected Portal content before the payload triggers. The scope change (S:C) means impact can extend into the victim's session and additional products beyond PeopleTools. Limiting factors that reduce real-world risk: the authentication requirement excludes anonymous internet attackers, the mandatory second-user interaction prevents fully automated mass exploitation, and only PeopleTools versions 8.61-8.63 are affected. Impact is partial - limited data read and limited unauthorized update/insert/delete, with no availability impact.

This is a moderate-severity issue (CVSS 3.1 base 5.4) that should be prioritized as part of routine Oracle Critical Patch Update (October 2026) remediation rather than treated as an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows network reachability over HTTP with low complexity, but exploitation is gated by two meaningful requirements: the attacker must already hold low-level privileges (PR:L) on the PeopleSoft Portal, and a separate victim must perform some interaction (UI:R). The scope change (S:C) combined with UI:R and partial, low confidentiality/integrity impact and no availability impact is the classic signature of a stored/reflected cross-site scripting or content-injection flaw where attacker-controlled content executes in another user's authenticated session - note that the input Tag 'Authentication Bypass' is inconsistent with this vector and appears mislabeled. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The signals are internally consistent and point to a real but bounded risk: real priority for internet-facing PeopleSoft portals used by many users, but not a drop-everything issue given the authentication and user-interaction prerequisites and the absence of any exploitation evidence.

A low-privileged but legitimate PeopleSoft Portal user injects a malicious payload (e.g., script or crafted content) into a Portal field or page that is later rendered to other users. When a higher-privileged user or administrator views that content, the payload executes in their authenticated session, allowing limited unauthorized read of data and unauthorized update/insert/delete of some data, with effects extending beyond PeopleTools (scope change). No public exploit code is identified at time of analysis.