A vulnerability in Oracle PeopleSoft Enterprise PeopleTools permits an attacker with low privileges over HTTP to create, delete, or alter data. The impact covers both confidentiality and integrity, enabling unauthorized access to critical information and manipulation of all data exposed by the application. The CVSS 3.1 base score of 8.1 reflects significant risk to the integrity and confidentiality of data within the system.

The products affected are Oracle Corporation’s PeopleSoft Enterprise PeopleTools, specifically versions 8.61 and 8.62. Users running these releases are exposed to the described exploit and must review their deployment for potential exposure.

The vulnerability can be triggered over a standard HTTP connection by an attacker with limited permissions, implying that any host with network visibility can attempt exploitation. The CVSS score indicates a high severity, but the EPSS is not available and the issue is not listed in CISA’s KEV catalog, suggesting that widespread exploitation may not yet be observed. Nonetheless, the low attack effort and clear impact warrant timely attention.