The vulnerability is located in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools, affecting versions 8.61 through 8.63. An attacker who can reach the application over HTTP, even without authentication, can manipulate or obtain sensitive data. The vulnerability requires human interaction from someone other than the attacker, meaning social engineering or phishing may be needed to trigger an exploitation attempt. Successful exploitation would let the attacker perform unauthorized insertions, updates, or deletions, and read protected data, potentially compromising the confidentiality and integrity of PeopleSoft applications and related downstream systems.

The affected product is Oracle PeopleSoft Enterprise PeopleTools. The specific vulnerable releases are 8.61, 8.62, and 8.63. No other Oracle products or versions are listed as compromised.

The CVSS 3.1 base score is 6.1, indicating moderate severity with low confidentiality and integrity impacts and no availability impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is HTTP network access. Because the vulnerability is unauthenticated and requires human interaction, exploitation is considered deliverable but not trivial; it necessitates social engineering to lure a legitimate user into completing the request sequence.