PeopleSoft Enterprise PeopleTools EUVD-2026-106449

Exploitation targets the Report Distribution component of PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 and requires network-reachable HTTP access to that component; no authentication is required (PR:N) and no user interaction is needed (UI:N). The decisive LIMITING factor is high attack complexity (AC:H) - Oracle designates the flaw 'difficult to exploit,' meaning success depends on conditions outside the attacker's control such as specific timing, server state, or a race, not merely sending a request. Impact is confined to confidentiality (unauthorized read access to critical data), with no integrity or availability effect, though the scope change (S:C) means exposed data may extend to additional products integrated with PeopleTools. Realistic exposure is further limited where Report Distribution is not reachable from untrusted networks.

This is a moderate-priority issue whose raw CVSS 3.1 base score of 6.8 is tempered by a critical mitigating metric. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N shows network-reachable, unauthenticated (PR:N) access over HTTP with no user interaction, which normally signals high exposure - but AC:H (Oracle explicitly labels it 'difficult to exploit') means successful attack depends on conditions outside the attacker's control (e.g., timing, specific state, or race conditions), which meaningfully suppresses real-world weaponization likelihood. Impact is confidentiality-only (C:H, I:N, A:N) with a scope change (S:C) indicating data beyond PeopleTools itself may be exposed. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no positive signal of active or imminent exploitation; combined with AC:H, this points toward a low near-term exploitation probability rather than a drop-everything emergency. Note a conflict to verify: the input Tags include 'Authentication Bypass,' but the Oracle description characterizes the flaw as unauthorized data access, not an authentication-bypass mechanism - treat the tag as unconfirmed. Priority should be driven by Oracle's standard patching cadence (Critical Patch Update October 2026) rather than emergency out-of-band response.

An unauthenticated attacker with network access to an internet- or intranet-exposed PeopleSoft Report Distribution endpoint sends crafted HTTP requests designed to trigger the flaw and read critical data they should not be able to access, potentially reaching data belonging to additional connected products due to the scope change. Because Oracle rates the flaw 'difficult to exploit' (AC:H), the attacker likely must satisfy specific timing or state conditions to succeed, and no public exploit code was identified at the time of analysis.