A vulnerability in the Application Server – JRE component of Oracle PeopleSoft Enterprise PeopleTools allows an unauthenticated attacker with network access via SSH to modify data stored in the system. The flaw permits unauthorized updates, inserts or deletes of data that is otherwise protected, thereby compromising the integrity of the application without affecting confidentiality or availability. The weakness corresponds to improper authorization checks and does not grant the attacker additional privileges beyond the limited data manipulation capability. The flaw is associated with CWE-200, indicating a potential for information exposure.

Affected vendors include Oracle Corporation. The product is Oracle PeopleSoft Enterprise PeopleTools, specifically the Application Server – JRE component. Versions 8.61 through 8.63 are affected. Customers running these versions should verify their installed versions and apply official patches as they become available.

This vulnerability carries a CVSS 3.1 score of 3.7, indicating a low severity but an integrity impact. The EPSS score is 0.00245 (approximately 0.25%) and the flaw is not listed in the CISA KEV catalog. The likely attack vector is remote access over SSH from an unauthenticated network source, with the attacker able to modify or delete application data but not gain additional privileges. Attackers need only network reachability and no authentication to exploit the flaw, making it a potential risk for exposed PeopleSoft servers.