PeopleSoft Enterprise PeopleTools EUVD-2026-106382

Exploitation targets the Portal component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 and is reachable remotely over HTTP by an unauthenticated attacker (PR:N). However, it is explicitly rated 'difficult to exploit' (AC:H), meaning success depends on a condition the attacker cannot directly control - such as a race, specific server state, or precise timing - which is the primary limiting factor. Impact is confined to unauthorized insert/update/delete of SOME PeopleTools-accessible data (partial integrity only); there is no data disclosure and no availability impact, further bounding realistic risk. No user interaction is required (UI:N), and scope is unchanged (S:U).

This is a genuinely low-priority vulnerability despite being network-reachable and unauthenticated. The CVSS 3.1 base score is 3.7 (LOW), and the vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) tells a consistent, coherent story: an attacker can reach it over HTTP without credentials (PR:N, AV:N), but exploitation is hard (AC:H), requiring conditions outside the attacker's control (e.g., timing, specific state, or a race), and the only consequence is LOW integrity impact (I:L) - unauthorized update/insert/delete of SOME accessible data, with zero confidentiality (C:N) and zero availability (A:N) impact. No EPSS score was provided in the input, no CISA KEV listing is present (so NOT confirmed exploited), and no public POC is referenced - therefore there is no public exploit identified at time of analysis. No SSVC decision data was supplied. The high attack complexity combined with a narrow, partial integrity-only impact makes this a low real-world risk that does not warrant emergency patching; it should be remediated during Oracle's normal quarterly CPU patch cycle. One caveat: the input Tag 'Authentication Bypass' conflicts with the description and vector, which describe a limited data-tampering flaw with no stated authentication-bypass mechanism - treat that tag as unreliable and verify against the Oracle CPU advisory.

A remote, unauthenticated attacker sends specially crafted HTTP requests to the PeopleSoft Portal interface and, by meeting a hard-to-control condition (high attack complexity), manages to perform unauthorized insert, update, or delete operations against a subset of PeopleTools data. No public exploit code is known, and the difficulty (AC:H) plus limited partial-integrity impact make reliable, repeatable exploitation unlikely in practice.