Oracle PeopleSoft Enterprise PeopleTools has a vulnerability in its Report Distribution component that allows an attacker with network access via HTTP to create, delete, or modify critical data. The flaw enables the attacker to tamper with or remove data that should remain protected, and can also cause the application to hang or repeatedly crash, resulting in a denial of service. The CVSS 3.1 vector indicates that confidentiality is not affected, but integrity and availability impacts are high. Based on the description of the vulnerability, it is inferred that the flaw originates from insufficient input validation or the absence of authentication checks, though the specific root cause is not stated in the advisory.

The affected product is Oracle PeopleSoft Enterprise PeopleTools. Versions 8.61 through 8.63 are explicitly mentioned as vulnerable, and no other versions or configurations are indicated as impacted in the advisory.

The vulnerability is reachable over standard HTTP without any authentication, so an attacker who can reach the infrastructure can attempt the exploit with minimal effort. However, successful exploitation requires a user other than the attacker to interact with the system—likely through social engineering or a compromised session. The EPSS score of <1% indicates that, at the time of reporting, the probability of exploitation was very low. The vulnerability is not listed in the CISA KEV catalog. Despite the low EPSS, the high CVSS score and the potential for widespread data tampering and denial of service contribute to a serious risk for organizations running the affected PeopleSoft versions.