A vulnerability was discovered in the PeopleSoft Enterprise PeopleTools product, specifically within the Tuxedo component, affecting versions 8.61 through 8.63. An unauthenticated attacker with network access over HTTP can read a subset of data that should be protected, resulting in a confidentiality compromise. The flaw does not grant code execution or broader system control, but it does allow the disclosure of sensitive information to unauthorized parties.

The affected systems are those running Oracle PeopleSoft Enterprise PeopleTools version 8.61, 8.62, and 8.63.

The CVSS base score of 3.7 indicates a low‑to‑moderate risk, with the primary impact on confidentiality. No publicly available EPSS score exists, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request from a remote network location. Although the likelihood of exploitation is unclear due to missing EPSS data, the exposure of proprietary data makes this a non‑negligible concern for organizations that rely on PeopleSoft for sensitive information.