A low‑privileged attacker who already has a logon to the underlying infrastructure can exploit a flaw in PeopleSoft Enterprise PeopleTools’ Analytic Server component to create, delete, or modify critical data, read sensitive information, or cause a partial denial of service.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are affected. The vulnerability resides in the Analytic Server component and requires that the attacker have local access to the system running PeopleSoft.

The CVSS v3.1 base score of 5.8 indicates moderate severity with impacts to confidentiality, integrity, and availability. The EPSS score is less than 1%, indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker possess a low‑privileged local account or otherwise has the ability to log onto the host where PeopleSoft is installed; from that position they can leverage the analytic server weakness to gain further access to sensitive data or degrade service.