PeopleSoft PeopleTools EUVD-2026-106384

Exploitation targets the Portal component of PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63, reachable remotely over HTTP by an unauthenticated attacker (PR:N/UI:N). The key LIMITING factor is high attack complexity (AC:H): Oracle classifies this as 'Difficult to exploit,' indicating success depends on conditions outside the attacker's control (such as specific application state, timing/race windows, or environmental preconditions) rather than a single deterministic request. Impact is further bounded to a subset of PeopleTools-accessible data (limited read plus limited update/insert/delete) with no availability impact, so a running, network-exposed PeopleSoft Portal in the affected version range is the primary prerequisite.

This is a moderate-severity issue (CVSS 3.1 base 4.8) that should be patched on a normal cycle rather than treated as an emergency. The strongest risk-reducing signal is AC:H - Oracle explicitly labels it 'Difficult to exploit' - which means successful attacks require conditions outside the attacker's control (e.g., winning a race, specific state, or non-trivial preparation), materially lowering the realistic exploitation rate despite the network, unauthenticated vector (AV:N/PR:N/UI:N). Impact is partial and bounded: C:L/I:L with A:N means limited read plus limited unauthorized update/insert/delete to a subset of PeopleTools-accessible data, not full compromise or availability loss. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization - this is not currently a priority-escalation candidate. Note a data tension worth flagging: the input Tags include 'Authentication Bypass', but the Oracle description describes unauthenticated access to a subset of data, not a bypass of an authentication control - verify the vulnerability class with Oracle before treating it as an auth-bypass. Overall this reads as a genuine but low-urgency flaw whose high attack complexity, not its exposure, is the limiting factor.

A remote, unauthenticated attacker reaches the PeopleSoft Portal over HTTP and sends a crafted request that, under specific non-default-timing or state conditions (reflected in the high attack complexity), coaxes PeopleTools into exposing or modifying a subset of application data. Because impact is limited to partial read and partial update/insert/delete, a realistic outcome is leakage or tampering of specific portal-accessible records rather than full system takeover. No public exploit code was identified at time of analysis, and the difficult-to-exploit rating means reliable weaponization is non-trivial.