Vulnerability in the Business Interlink component of Oracle PeopleSoft Enterprise PeopleTools allows an attacker who already has high‑privileged access to the underlying infrastructure to compromise the PeopleSoft application. The flaw exposes unauthorized update, insert, or delete capabilities over data, enables reading sensitive data that should be protected, and can trigger a partial denial of service, resulting in loss of confidentiality, integrity, and a measurable impact on availability.

Affected vendor is Oracle Corporation, product PeopleSoft Enterprise PeopleTools, versions 8.61 through 8.63. The vulnerability is specific to the Business Interlink module within those releases.

With a CVSS v3.1 base score of 3.9, the threat is low to moderate, but it requires high privileged credentials and a local foothold. The EPSS score is 0.00097 (less than 1%), and the flaw is not listed in the CISA KEV catalog, suggesting it is not actively exploited in the wild. Nonetheless, if an attacker can leverage the necessary privileges, they can modify or delete application data and disrupt service. The impact is confined to the PeopleSoft environment and does not provide broader network compromise.