A flaw in the Database Server component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 allows an unauthenticated attacker with HTTP network access to trigger a hang or full crash of the application, causing a denial of service. In addition, once a brief human interaction activates the flaw, the attacker can update, insert, or delete data and read a subset of the database, thereby violating confidentiality, integrity, and availability. This weakness is a CWE‑400 Uncontrolled Resource Consumption, which underpins the impact described. These effects are represented by the CVSS v3.1 score of 7.6 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H).

The affected systems are Oracle PeopleSoft Enterprise PeopleTools releases 8.61 through 8.63, specifically the Database Server module. All installations of these versions that expose the database server to HTTP traffic are at risk.

The CVSS base score of 7.6 indicates high severity while the EPSS score of less than 1% suggests a very low, but nonzero, probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Authentication is not required, so an attacker can reach the vulnerable endpoint over the network; however, the necessity of a human interaction limits instant exploitation. Once triggered, the resulting denial of service and data integrity violations can severely impact business operations.