An unauthenticated attacker who can reach the PeopleSoft Enterprise PeopleTools application over HTTP can exploit a flaw in the Business Interlink component. The vulnerability enables the attacker to compromise PeopleSoft Enterprise PeopleTools, allowing them to gain full control of the application and potentially all data it manages. The CVSS 3.1 score of 8.1 highlights substantial impacts to confidentiality, integrity, and availability.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools product, specifically versions 8.61 through 8.63, is affected. The tool set is the Business Interlink component within the PeopleSoft PeopleTools suite.

The CVSS base score of 8.1 indicates serious risk, and the vulnerability is exploitable over the network without authentication. While the EPSS score is not available, the lack of CISA KEV listing does not reduce the intrinsic danger, as the flaw can be leveraged by any network‑connected adversary. The most likely attack vector is an unauthenticated HTTP session targeting exposed PeopleSoft endpoints, potentially via automated exploit tools.