PeopleSoft PeopleTools EUVD-2026-36199

The target must be running Oracle PeopleSoft Enterprise PeopleTools version 8.61 or 8.62 with the Updates Environment Management component reachable over HTTP from the attacker's network position; no authentication, user interaction, or non-default configuration is required (AV:N/AC:L/PR:N/UI:N). Practical limiting factors are network reachability of the PeopleTools web tier (organizations that expose only the self-service portal through a reverse proxy and keep PeopleTools management interfaces on internal networks reduce, but do not eliminate, exposure) and the relatively narrow version window - older PeopleTools 8.60 and earlier are not listed as affected per the description.

All signals point to high priority: CVSS 9.8 with AV:N/AC:L/PR:N/UI:N means a remote, unauthenticated attacker can exploit over HTTP with low complexity and no user interaction, and Oracle itself characterizes the flaw as 'easily exploitable' resulting in product takeover. No EPSS score, KEV listing, or public POC was supplied in the input, so real-world exploitation velocity is currently unknown - this is a gap, not a reassurance. PeopleSoft deployments typically front-end through PIA web servers reachable from corporate networks (and sometimes the internet for self-service portals), which materially raises the realistic blast radius. The absence of CWE and KEV data should not be read as low risk; Oracle Critical Patch Update advisories historically attract scanner and red-team interest within days of release.

An attacker scans an organization's external or VPN-reachable IP ranges, identifies a PeopleSoft PIA web tier running PeopleTools 8.61 or 8.62, and sends a crafted unauthenticated HTTP request to the Updates Environment Management component. The single request yields full takeover of the PeopleTools instance, giving the attacker control over ERP application servers, access to HR/finance data, and a foothold to pivot into the Oracle database tier. No public exploit identified at time of analysis, but the low complexity described by Oracle makes weaponization within reach of moderately skilled attackers once the patch is reverse-engineered.