The vulnerability lies in the Test Framework component of Oracle PeopleSoft Enterprise PeopleTools and permits an attacker who has local logon credentials to perform unauthorized updates, inserts, or deletions to data accessible through the application. In addition, the attacker can read restricted data, and can trigger a partial denial of service that impacts availability. This weakness is a classic example of improper authorization (CWE‑284).

Oracle Corporation provides PeopleSoft Enterprise PeopleTools; versions 8.61 through 8.63 are affected.

The CVSS score of 5.3 indicates significant impacts to confidentiality, integrity, and availability. The attack vector is local, requiring only low privileged access with system logon. The EPSS score is not available, and the vulnerability is not included in the CISA KEV catalog. Because an attacker needs local access, the risk is moderate for environments where privileged accounts are widespread or poorly controlled. Proper mitigation reduces the window of opportunity for exploitation.