The identified flaw resides in the Application Server JRE component of Oracle PeopleSoft Enterprise PeopleTools. It grants an attacker who already possesses high‑privileged, local access to the host that runs the application the ability to compel the JRE to read sensitive data, resulting in a confidentiality compromise. The CVSS vector highlights a high impact on confidentiality with no integrity or availability effects, reflecting the inability of the flaw to cause denial of service or data modification. This manifests as an information exposure weakness, consistent with CWE‑200.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63. No other versions are listed as affected.

The CVSS base score of 4.4 indicates a low severity rating. Because the exploit requires the attacker to be already logged into the underlying infrastructure with high privileges, the attack surface is limited to hosts where the application runs. The EPSS score of 0.00155 indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known exploit activity. However, the potential damage—unauthorized access to critical data—remains significant, warranting prompt assessment and mitigation.