The vulnerability resides in the PeopleSoft Enterprise PeopleTools product’s SQR component and permits an attacker with low privileges but network access via HTTP to create, delete, or modify critical data. The flaw also allows unauthorized access to sensitive information, leading to potential data tampering and privacy violations. According to the CVSS 3.1 vector, the attack is network‑based, requires low privileges, and forces significant confidentiality and integrity loss, while availability remains unaffected.

Organizations running Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are impacted. The vulnerability is specific to the SQR component and may affect other PeopleSoft products that rely on the affected component. No other versions are known to be compromised.

With a CVSS base score of 9.6, this flaw is rated Critical. The EPSS score is not available, indicating no public data on exploitation probability, and the issue is not yet listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely over HTTP without special credentials, making it highly actionable for individuals with limited access. The vulnerability’s scope change suggests that a successful attack could propagate to other dependent PeopleSoft components, increasing the overall risk to the environment.