PeopleSoft PeopleTools EUVD-2026-46534

Exploitation requires the attacker to hold a low-privileged authenticated account within the PeopleSoft environment (PR:L per CVSS) - unauthenticated exploitation is not indicated. The attack is delivered over HTTP via network access (AV:N, AC:L), meaning no special network position is required beyond standard access to the PeopleSoft web tier. Critically, exploitation also requires human interaction (UI:R) from a victim user other than the attacker - the victim must perform some action (e.g., click a link, load a page) to trigger the vulnerability. The scope change (S:C) means impact is not limited to PeopleTools itself and can extend to other PeopleSoft products sharing the environment. Limiting factors include: mandatory authenticated access (PR:L restricts anonymous exploitation), mandatory victim interaction (reduces scalability of attacks), and the relatively narrow data impact (C:L/I:L - partial data access/modification only, no availability impact).

The Oracle-assigned CVSS 3.1 base score is 5.4 (Medium), reflecting meaningful but bounded impact: low confidentiality and low integrity impact with no availability impact, requiring both authenticated access and victim interaction. The S:C (scope change) metric elevates real-world risk slightly beyond the base score suggests, as successful exploitation can ripple into additional PeopleSoft application modules. The 'Authentication Bypass' tag is notable but partially inconsistent with PR:L - full unauthenticated bypass is not indicated by the vector; the bypass likely applies to a specific authorization check within an already-authenticated session. No EPSS data was provided, no CISA KEV listing exists, and no public proof-of-concept has been identified, all of which lower operational urgency. Real-world risk is most significant in environments where PeopleSoft is exposed to a broad population of low-privileged users (e.g., self-service HR portals), where the attacker pool is larger and UI:R interaction is more easily social-engineered.

A low-privileged attacker with a valid PeopleSoft account delivers a crafted HTTP request - likely a malicious link or embedded payload targeting the PeopleTools Security component - and social-engineers a higher-privileged or victim user to interact with it. Upon interaction, the attacker's payload executes within the victim's session context, allowing unauthorized read of accessible PeopleTools data and unauthorized modification of some records, with the scope change potentially allowing lateral impact into other PeopleSoft application modules sharing the same session boundary. No public proof-of-concept exists at time of analysis.