PeopleSoft PeopleTools EUVD-2026-106291

Exploitation requires access to the PeopleSoft Enterprise PeopleTools Portal component over HTTP with a valid low-privileged account (PR:L) - it is NOT unauthenticated. It additionally requires human interaction from a victim other than the attacker (UI:R), typically luring that victim into clicking a crafted link or rendering attacker-influenced Portal content. Oracle explicitly rates it 'difficult to exploit' (AC:H), meaning additional conditions outside the attacker's control (e.g., specific timing, configuration, or victim behavior) must be met. These factors - mandatory authentication, required second-party interaction, and high complexity - substantially limit realistic exploitation. Affected only on PeopleTools versions 8.61 through 8.63.

This is a genuinely low-priority issue despite being network-reachable. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N, base 3.0 LOW) describes a flaw that is network-accessible over HTTP but hard to exploit: it requires high attack complexity, an already-authenticated low-privileged account (PR:L), AND human interaction from a victim other than the attacker (UI:R). Impact is limited to unauthorized read access to a subset of data (C:L) with no integrity or availability impact. The scope change (S:C) plus UI:R and C:L is the classic signature of a cross-site-scripting / content-injection style defect in the Portal component. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' NOTE: the input Tag 'Authentication Bypass' conflicts with the actual vulnerability, which requires PR:L (an existing authenticated session) and yields only limited read access - it is not an authentication bypass; treat that tag as unreliable. Bottom line: low real-world risk, patch during normal Oracle CPU cycles rather than as an emergency.

A low-privileged authenticated PeopleSoft Portal user crafts a malicious link or payload and lures a higher-value victim (e.g., another portal user or administrator) into interacting with it; when the victim's browser renders the attacker-influenced Portal content, a subset of that victim's accessible data is disclosed to the attacker. The high attack complexity and mandatory victim interaction make this difficult and opportunistic rather than reliable, and no public exploit code is known.