The flaw resides in the Query component of Oracle PeopleSoft Enterprise PeopleTools. An attacker with high privileged credentials who can reach the system via HTTP can trigger an input validation error that leads to a system crash (Denial of Service) and unauthorized changes to or reads of protected data. The vulnerability provides limited, yet significant, confidentiality, integrity, and availability impact, with a CVSS 3.1 score of 5.5.

The affected product is Oracle PeopleSoft Enterprise PeopleTools version 8.61 and 8.62. These versions are reported by Oracle as vulnerable in the October 2026 CPU alert. The components accessed over HTTP on network‑connected hosts are the primary attack surface.

The CVSS base score of 5.5 rates the vulnerability as medium, while the EPSS score of less than 1 % indicates a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The attack path requires network access to the HTTP interface and the attacker must already possess high‑privileged credentials to exploit the bug. Although it does not enable remote code execution, successful exploitation could disrupt PeopleSoft operations and compromise sensitive data if not mitigated.