PeopleSoft PeopleTools EUVD-2026-106517

Requires a valid low-privileged PeopleSoft Enterprise PeopleTools account (PR:L) with network access to the application over HTTP, targeting the Notification Configuration component on affected versions 8.61 through 8.63. Exploitation is rated high-complexity (AC:H), meaning success depends on specific conditions outside the attacker's direct control rather than default settings, which materially limits real-world exploitability. Limiting factors: authentication is mandatory (no anonymous attack), no user interaction by a victim is needed (UI:N), and impact is bounded to Low confidentiality and Low integrity with no availability effect - the primary amplifier is the scope change that can reach additional integrated products.

This is a genuinely moderate, not high-urgency, issue. The CVSS 3.1 base score is 4.9 (Medium), and the vector tells a consistent, limiting story: AV:N (HTTP-reachable) but AC:H (difficult to exploit, requires conditions outside attacker control) and PR:L (a valid low-privileged PeopleSoft account is required), with only Low confidentiality and Low integrity impact and no availability impact. The scope change (S:C) is the one aggravating factor - Oracle explicitly states attacks may significantly impact additional products beyond PeopleTools - which is why the C:L/I:L impacts still produce a mid-range score. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a real but low-priority patch item (authenticated, high-complexity, limited-impact) rather than an emergency; prioritize it within normal Oracle Critical Patch Update cadence, with slightly elevated attention where PeopleTools is integrated with other sensitive downstream systems because of the scope change. Note a metadata conflict: the input Tag 'Authentication Bypass' contradicts the CVSS PR:L requirement (a valid low-privileged account is needed), so the vulnerability is NOT an authentication bypass - verify tag provenance.

A low-privileged but authenticated PeopleSoft user sends a crafted HTTP request to the Notification Configuration component and, under specific non-default conditions (reflecting AC:H), abuses the flaw to read a subset of and modify some PeopleTools-accessible data. Because the scope changes, the manipulation can propagate to affect additional integrated Oracle products beyond PeopleTools. No public exploit code is known, so an attacker would need to develop the technique and already possess valid credentials.