PeopleSoft Enterprise PeopleTools EUVD-2026-106385

Requires a network-reachable PeopleSoft Enterprise PeopleTools instance running an affected version (8.61 through 8.63) with the LDAP component in use/exposed over HTTP. Per the provided CVSS vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and only low complexity are needed, so default reachable deployments are exposed to unauthenticated attackers. Limiting factors: exploitation is bounded to the LDAP component and to partial impact (read of a data subset plus some unauthorized write/delete, no availability impact), and exposure depends on whether the PeopleTools web tier is reachable by the attacker (internet-facing versus internal-only) - internal-only or tightly segmented deployments materially reduce real-world risk.

This is a moderate-severity, genuinely network-exploitable issue rather than a top-tier emergency. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) is internally consistent with the description: Oracle explicitly calls it 'easily exploitable' by an 'unauthenticated attacker with network access via HTTP,' which matches AV:N/AC:L/PR:N/UI:N. Because PR:N is present in the provided vector, unauthenticated exploitation is supported by the data. However, impact is partial - low confidentiality and low integrity, no availability impact - so this yields read access to a subset of data and unauthorized update/insert/delete to some data, not full system compromise. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active exploitation or available exploit code; per the precision rules this is 'no public exploit identified at time of analysis.' SSVC-style reasoning: exploitation status appears to be none/proof-of-concept-absent, the flaw may be automatable given AV:N/AC:L/PR:N, but technical impact is partial, which argues against the highest priority tier. Note a tagging tension: the input carries an 'Authentication Bypass' tag, but the description characterizes the outcome as unauthorized data read/write via the LDAP component, not a described authentication-bypass mechanism - treat the 'Authentication Bypass' label as unverified against the official text and confirm with Oracle.

A remote, unauthenticated attacker sends crafted HTTP requests to an internet-facing or network-reachable PeopleSoft PeopleTools instance (versions 8.61-8.63), abusing the LDAP component to read a subset of application data and to perform unauthorized insert, update, or delete operations on some accessible data. Given AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and only low attack complexity are required. No public proof-of-concept or exploit code was identified in the provided intelligence.