A flaw in the SQR component of Oracle PeopleSoft Enterprise PeopleTools lets an unauthenticated user who can log on to the infrastructure execute privileged operations, requiring the interaction of a third party. Successful exploitation can compromise the entire PeopleSoft application, allowing an attacker to alter or delete data, disrupt services, and ultimately take over the system. The weakness is modeled by CVSS v3.1 as AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access, high difficulty, no privileges required, and user interaction.

Oracle PeopleSoft Enterprise PeopleTools versions 8.61, 8.62, and 8.63 contain the vulnerable SQR component and are affected by this vulnerability. The issue applies to installations that host the PeopleSoft application on the described infrastructure.

The CVSS base score of 7.0 denotes a medium‑to‑high impact. Exploitation requires local infrastructure access and the presence of a separate user to provide the necessary interaction, meaning automated attacks are unlikely. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, but the potential for application takeover warrants prompt mitigation.