The Data Mover component of Oracle PeopleSoft Enterprise PeopleTools contains a flaw that allows an attacker who already has high‑privilege access and a logged‑on session on the underlying infrastructure to modify, insert, or delete data that should otherwise be protected. The same vulnerability also permits the attacker to read data that should be restricted and to trigger a partial denial of service. This compromise affects the confidentiality, integrity, and availability of the data handled by the component.

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are affected. The flaw resides in the Data Mover feature, which is part of the PeopleTools suite and runs on Oracle infrastructure. Customers deploying any of these versions should verify whether Data Mover is enabled and address the issue.

The CVSS base score of 3.8 signifies a low‑severity risk, and the attack vector is local with high privileges and required user interaction. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Although the likelihood of exploitation is small, the potential impact on confidential data and operational continuity warrants timely mitigation.