The vulnerability resides in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools and allows an attacker who is authenticated nothing at all to access sensitive data. Without any authentication requirement, an unauthenticated attacker who can reach the application over the network can gain full read access to all information stored in the PeopleSoft database. The weakness directly impacts the confidentiality of the data, exposing critical business information and is classified as a high‑severity flaw with a CVSS base score of 7.5.

Oracle Corporation PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are affected. The flaw is present in the Report Distribution component. No other vendors, products or versions are known to be vulnerable based on the current CNA information.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates that the flaw is network‑based, requires no privileges or user interaction, and provides only confidentiality impact. Although no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the lack of authentication barrier makes the attack path straightforward for any attacker with network access to the PeopleSoft HTTP service. If exploited successfully, the attacker would obtain unauthorized read access to all data accessible through the PeopleSoft application.