The flaw lies in the Push Notifications component of Oracle PeopleSoft Enterprise PeopleTools. A high‑privileged attacker who can reach the physical communication segment attached to the hardware where the software runs can exploit the vulnerability to take control of the PeopleSoft instance. The known vector, AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, illustrates that once the attacker gains local physical access, full confidentiality, integrity, and availability are compromised, effectively allowing takeover of the application.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 are affected. These versions are installed on enterprise servers that handle critical business processes, so any affected deployment may be vulnerable.

The CVSS 3.1 base score of 6.8 reflects moderate severity with severe impacts on all CIA goals. EPSS score is less than 1%, and the vulnerability is not listed in the CISA’s KEV catalog, indicating no public exploitation yet. Nevertheless, because the required condition is physical access to the hardware that hosts the PeopleSoft service, the risk is elevated for environments where physical security is weak. Exploitation requires local privilege escalation and control over the physical line, but once achieved, it can lead to full application takeover.