The flaw resides in the Integration Broker of Oracle PeopleSoft Enterprise PeopleTools. An attacker who can reach the affected instances over HTTP can exploit the vulnerability without knowing credentials; however the attack requires some human participation from a user other than the attacker—often via social engineering or user‑initiated action. Once the vulnerability is leveraged, the attacker can read all data that the application can access or, at a minimum, read, insert, update, or delete critical information. This results in a breach of confidentiality and a compromise of data integrity. The CVSS score of 7.1 indicates moderate to high impact on confidentiality, with a lower but still noteworthy effect on integrity.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools product, specifically the Integration Broker component, is affected. Oracle documents supported versions 8.61 through 8.63 as vulnerable. No other vendors or product versions are listed.

The CVSS vector shows the attack can be conducted over the network via HTTP with no special privileges required, but it does involve required user interaction. The EPSS score is reported as less than 1%, indicating a very low exploitation probability; nevertheless, the vulnerability is not yet catalogued in CISA’s KEV list. The high confidentiality impact coupled with the potential for complete data compromise means that, if an attacker can reach the Integration Broker endpoint and coerce a user into action, the system could be fully compromised. Because the flaw can be triggered from external traffic, organizations should treat this as a significant risk and prioritize remediation.