PeopleSoft PeopleTools EUVD-2026-61454

Exploitation requires: (1) the attacker must have already achieved logon access to the infrastructure where PeopleSoft Enterprise PeopleTools executes - this is a local attack vector, not remotely exploitable over a network; (2) the attacker must hold high-privileged credentials on that infrastructure (PR:H); (3) a human other than the attacker must interact with the system as part of the attack (UI:R); (4) the specific vulnerable component is Data Mover, so Data Mover must be installed and accessible on the target system; (5) attack complexity is rated High (AC:H), implying specific timing, race conditions, or configuration states must align. Exploitation is limited by the requirement for pre-existing infrastructure access with elevated privileges, human interaction, and favorable environmental conditions - ruling out remote, unauthenticated, or automated mass exploitation. The 'Authentication Bypass' tag warrants clarification from Oracle: if this refers to bypassing internal Data Mover authorization rather than system authentication, the PR:H constraint remains binding.

The CVSS 3.1 base score of 7.2 reflects a meaningful but operationally constrained threat. The attack vector is local (AV:L), complexity is high (AC:H), privileges required are high (PR:H), and user interaction is required (UI:R) - all significant limiting factors that substantially reduce exploitability in practice. EPSS data is not provided; without it, statistical exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no public POC has been identified, indicating no confirmed active exploitation. The tags include 'Authentication Bypass', which is in tension with the PR:H requirement - this discrepancy should be flagged: the tag may refer to an internal bypass within the Data Mover component post-authentication, not a bypass of initial system authentication. The scope change (S:C) elevates theoretical impact, but given the local, high-privilege, high-complexity entry conditions, opportunistic exploitation is unlikely. This is a lower-priority patch for most organizations compared to network-accessible, low-complexity CVEs, but warrants attention in environments where PeopleSoft infrastructure access is shared or where insider threat is a concern.

An attacker who has already obtained high-privileged access to the PeopleSoft application server (e.g., via compromised service account credentials or lateral movement from another host) invokes or manipulates the Data Mover component in a manner that exploits its authentication or privilege handling flaw. The attack requires a secondary user - such as a DBA or administrator - to interact with the system concurrently or in response to an attacker-crafted condition. Upon successful exploitation, the attacker gains read and write access to all PeopleTools-accessible data across the database, potentially impacting connected PeopleSoft application modules and their underlying data stores.