The vulnerability is in the Data Mover component of Oracle PeopleSoft Enterprise PeopleTools, affecting versions 8.61 through 8.63. An attacker who has high privileged access to the infrastructure where PeopleSoft runs can exploit the flaw to create, delete, or modify data and to gain unauthorized access to all data accessible through the application. The flaw also permits a partial denial of service. The attack requires the attacker to have elevated privileges and to obtain user interaction from a person other than the attacker, making it harder to exploit than a pure remote vulnerability but still achievable in an internal environment.

The affected product is Oracle’s PeopleSoft Enterprise PeopleTools, specifically versions 8.61, 8.62, and 8.63. The Data Mover component is the source of the flaw. No other vendors or products are listed as directly impacted, though the description notes that the vulnerability may have a scope change that could affect additional PeopleSoft products when exploited.

The CVSS v3.1 Base Score of 7.2 reflects high confidentiality and integrity impact and medium availability impact, with a vector indicating limited attack surface (local) and high privilege required. Because the exploitation path needs a high‑privileged system account and a separate user interaction, the overall exploitability is lower than a remote attack but still represents a significant risk to environments where privileged accounts are present. The KEV database does not list this vulnerability and EPSS data are not available, so the exact exploitation probability cannot be quantified. Nonetheless, the combination of privilege escalation, scope change, and potential data tampering warrants prompt patching or mitigation.