An unauthenticated attacker who can reach PeopleSoft Enterprise PeopleTools over HTTP may exploit a flaw in the Business Interlink component. The vulnerability permits the attacker to compromise the application and gain full control, potentially accessing and modifying all data it manages. The CVSS 3.1 score of 8.1 reflects substantial impacts to confidentiality, integrity and availability when this flaw is leveraged.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools product, versions 8.61 through 8.63, is affected. The flaw resides in the Business Interlink component of PeopleTools.

The CVSS base score of 8.1 indicates serious risk, and the EPSS score of <1% shows a low but non‑zero probability of exploitation. The lack of a CISA KEV listing does not diminish the danger, as any network‑connected adversary could target the exposed HTTP endpoints. The likely attack vector is an unauthenticated HTTP session to Business Interlink URLs, potentially automated by exploit tools.