PeopleSoft Enterprise PeopleTools contains a vulnerability in its Updates Change Assistant component that allows a high‑privileged attacker with network access via HTTP to gain unauthorized access to critical data or complete access to all data accessible by the application, and to cause a partial denial of service. The vulnerability is easily exploitable, with the CVSS 3.1 Base Score of 5.5 reflecting impacts to confidentiality and availability.

Oracle Corporation PeopleSoft Enterprise PeopleTools versions 8.61, 8.62, and 8.63 are affected.

The CVSS score of 5.5 indicates moderate risk, but the vulnerability’s low attack complexity (HTTP) and high privilege requirement suggest that an attacker with sufficient access could compromise the application. The EPSS score of 0.00407 (approximately 0.4%) indicates a very low exploitation probability, and the vulnerability is not listed in CISA KEV, so there is no known active exploitation in the wild, yet the potential for unauthorized data access warrants prompt action.