Oracle PeopleTools EUVD-2026-37408

Exploitation requires HTTP network reachability to the PeopleSoft Internet Architecture and specifically to the Performance Monitor component endpoints of PeopleTools 8.61 or 8.62; no user interaction or authentication is required per PR:N/UI:N. Limiting factors are significant: AC:H indicates a non-trivial precondition (timing, specific PPM configuration, or required chained state), the vulnerability is scoped to the Performance Monitor component so deployments that block external access to PPM URLs are not exposed, and only the two listed PeopleTools releases are affected - older releases and other PeopleSoft Enterprise application modules (HCM, FSCM, etc.) are not in scope of this CVE.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a high-impact, internet-reachable, unauthenticated flaw that Oracle nevertheless rates as difficult to exploit, which typically implies a non-trivial precondition such as timing, specific configuration, or chained primitives. EPSS data was not supplied with this analysis, the vulnerability is not on CISA KEV, and no POC has been published, so real-world risk currently sits below what the 8.1 score alone suggests. That said, PeopleSoft systems are frequently business-critical (HR, financials, student records) and 'takeover' is the most severe Oracle outcome category, so any internet-exposed PeopleSoft Performance Monitor endpoint should be treated as a high-priority patching target. Note that 'Information Disclosure' tag conflicts with the CVSS C:H/I:H/A:H 'takeover' impact - trust the Oracle CPU vector over the third-party tag.

An unauthenticated attacker who can reach the PeopleSoft Internet Architecture over HTTP sends a crafted request to a Performance Monitor endpoint on the PIA web tier; after meeting the difficult-to-exploit precondition (e.g., a specific timing or configuration state), the request is processed in a way that yields code or session control inside the PeopleTools runtime, resulting in full takeover. With takeover-level access the attacker can read HR/financial data, pivot to the underlying app/DB tiers, and disrupt business operations. No public exploit identified at time of analysis.