Unauthenticated network requests to the Deployment Package component of Oracle PeopleSoft Enterprise PT PeopleTools allow an attacker to read or modify critical data without authentication. The vulnerability is exploitable over HTTP and can expose confidential information (Confidentiality Impact: High) and enable data tampering (Integrity Impact: Low). The severity is reflected in a CVSS 3.1 Base Score of 8.2.

Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62 are affected. No other versions were listed as vulnerable.

The vulnerability has an Attack Vector of Network, Access Complexity of Low, no Privileges Required, no User Interaction, and is Unchanged Scope. The EPSS score is under 1%, indicating a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Attackers can target the publicly reachable Deployment Package endpoint to extract or alter data, assuming the application is exposed to the internet or an internal network without additional defenses.