A defect in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools enables an unauthenticated attacker with network access over HTTP to execute arbitrary code and ultimately take over the application. The vulnerability is easily exploitable and, once triggered, compromises confidentiality, integrity, and availability, giving the attacker full control of the affected system. The weakness is a classic example of improper access control that allows execution of privileged functions without proper authorization.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools, specifically versions 8.61 and 8.62, are impacted. These products are used by enterprises for HR, finance, and other critical business functions.

With a CVSS 3.1 base score of 9.8, this flaw is considered critical. The EPSS score is not available, but the fact that the vulnerability is exploitable over an open HTTP interface and requires no authentication or user interaction means a real‑world attacker could potentially compromise multiple systems with minimal effort. The vulnerability is not yet listed in the CISA KEV catalog, although it remains an urgent concern due to its high severity and availability of network access.