The vulnerability is located in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools, affecting versions 8.61 through 8.63. This is a missing authentication weakness (CWE-306). An attacker who can reach the application over HTTP, even without authentication, can manipulate or obtain sensitive data. The vulnerability requires human interaction from someone other than the attacker, meaning social engineering or phishing may be needed to trigger an exploitation attempt. Successful exploitation would let the attacker perform unauthorized insertions, updates, or deletions, and read protected data, potentially compromising the confidentiality and integrity of PeopleSoft applications and related downstream systems.

Oracle PeopleSoft Enterprise PeopleTools versions 8.61, 8.62, and 8.63 are impacted; no other Oracle products or versions are listed as affected.

The CVSS 3.1 base score of 6.1 indicates moderate severity with low confidentiality and integrity impact, and no availability impact. The EPSS score is <1% (approximately 0.25%), indicating very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Likely attack vector is HTTP network access, requiring unauthenticated access and human interaction from a legitimate user other than the attacker. These prerequisites make exploitation more challenging but feasible through social engineering or phishing campaigns that convince an authorized user to execute the vulnerable request sequence. Because the flaw permits unauthorized data update, insert, delete, and read actions, its impact can extend to downstream applications that rely on PeopleSoft data.