An unauthenticated attacker who has logged onto the same infrastructure where PeopleSoft Enterprise PeopleTools runs can use this vulnerability to update, insert, or delete data accessible to the application. The flaw is a local data integrity issue that undermines the system’s guarantee of data integrity. The weakness involves insufficient access control and authorization checks, corresponding to the CWEs CWE‑284 and CWE‑862. The CVSS 3.1 base score of 2.9 indicates a low severity rating but confirms that the primary consequence is integrity damage.

The vulnerability impacts Oracle Corporation’s PeopleSoft Enterprise PeopleTools, versions 8.61 through 8.63. The flaw resides in the Porting component of the product. Any deployment of these versions that is reachable from an attacker who can log onto the underlying operating system is susceptible.

The attack vector requires local access to the infrastructure hosting PeopleSoft Enterprise PeopleTools; it is not remotely exploitable via the web application interface. Exploitation is described as difficult, and no publicly known exploits have been reported. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Consequently, the likelihood of exploitation is low, but the impact on data integrity remains significant if an attacker succeeds.