The flaw originates in PeopleSoft Enterprise PeopleTools’ Search Framework, permitting an attacker who can reach the physical network segment attached to the PeopleSoft hardware to bypass authentication and gain unauthorized access to critical or all accessible data. The vulnerability specifically enables confidentiality compromise without affecting integrity or availability, as reflected by the CVSS 3.1 vector that shows no impact on integrity or availability and a high confidentiality impact.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools, versions 8.61 and 8.62, are affected. The product runs on the specified hardware where the physical communication segment provides the attack surface.

The CVSS 3.1 base score is 5.3, indicating medium severity. The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog. The attack requires local physical or network access to the segment on which PeopleSoft operates, making it a high‑cost, low‑risk vector in environments with well‑secured premises. An attacker with such access could extract confidential information by leveraging the unprotected Search Framework component.