Vulnerability in the SQR component of Oracle PeopleSoft Enterprise PeopleTools permits a local, high‑privilege user to change critical data or terminate the application. The flaw requires the attacker to have an existing login on the infrastructure that hosts PeopleSoft and to interact with a person other than themselves. Successful exploitation can result in unauthorized creation, deletion, or modification of data and can also cause the application to hang or crash, disrupting availability. The attack does not expose confidential data but severely undermines integrity and availability.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are impacted. The scope change indicated by the CVSS vector implies that, while the vulnerability exists in PeopleSoft, an exploited flaw could affect other related products or modules that operate on the same infrastructure. If your environment runs any of these specific releases, it is likely affected.

The CVSS v3.1 score of 6.9 indicates a moderate to high risk, with the exploit requiring local access, high privilege, and user interaction. Remote attackers cannot directly exploit this flaw; it is limited to insiders or attackers who can log in as a privileged user. The EPSS score is not available, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting that, while technically feasible, it is not yet widely exploited. Nevertheless, the potential for data tampering and denial of service warrants prompt action from affected organizations.