The PeopleSoft Enterprise PeopleTools product contains a flaw in its Business Interlink component that can be triggered by an unauthenticated attacker who has network connectivity via HTTP. Through this flaw the attacker can gain unauthorized control of the application, effectively taking over the entire PeopleSoft instance. The impact on confidentiality, integrity and availability is complete, since the attacker can execute arbitrary commands and exfiltrate sensitive data. The flaw is a classic case of improper access control (CWE‑284) with elements of authentication bypass (CWE‑287).

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63, all containing the Business Interlink component.

The vulnerability carries a CVSS 3.1 base score of 8.1, indicating high risk. The EPSS score is not provided, and the bug is not listed in the CISA KEV catalog, suggesting that active exploitation may be limited at present but cannot be ruled out. Exploitation is considered difficult due to required HTTP traffic and lack of publicly documented payloads, but a determined attacker with network access can complete the attack vector. Consequently, stakeholders should treat this as a high priority.