PeopleSoft PeopleTools EUVD-2026-106442

Exploitation requires the attacker to already have a valid low-privileged logon (PR:L) to the infrastructure where PeopleSoft Enterprise PeopleTools executes, and to interact with the XML Publisher component locally (AV:L) - there is no remote or unauthenticated path. Limiting factors: only PeopleTools versions 8.61 through 8.63 are affected; the attacker must hold existing credentials; and the outcome is restricted to unauthorized read access to a subset of PeopleTools data (no write/integrity or availability impact), which bounds realistic damage. No end-user interaction is needed (UI:N).

This is a low-severity, low-priority issue despite being an Oracle Critical Patch Update item. The CVSS 3.1 base score of 3.3 (LOW) is consistent across all signals: the vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) describes a LOCAL attack vector requiring an already-authenticated low-privileged account, yielding only partial (Low) confidentiality disclosure with no integrity or availability impact. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The SSVC framework is not supplied, but the technical impact is partial and the attack is not automatable (requires interactive local logon), reinforcing a low real-world priority. One data conflict must be flagged: the input Tags include 'Authentication Bypass,' which contradicts the CVSS vector's PR:L (authentication IS required) and the description's limited read-only impact - this appears to be a mislabeled tag and should not drive triage. Overall this is a genuinely low-risk information-disclosure flaw, not a high-CVSS-but-overstated issue; it is correctly scored low.

An attacker who already holds a valid low-privileged PeopleSoft/PeopleTools application or infrastructure account logs in and abuses the XML Publisher component to read a subset of data they should not have access to. Because the vector is local (AV:L) and only partial confidentiality is impacted, the result is limited unauthorized read access rather than full compromise. No public proof-of-concept exploit is referenced in the available data.