The vulnerability is located in the Open Query component of Oracle PeopleSoft Enterprise PeopleTools. It allows an attacker who has high‑privileged local access to the infrastructure that hosts the application to read a limited portion of data that would normally be confined within the system. The flaw does not modify data, disrupt service, or provide additional privileges; it only exposes confidential information, reflected in the low confidentiality impact of the CVSS score. The affected releases are PeopleSoft Enterprise PeopleTools 8.61 and 8.62, with no impact on earlier or later versions. Because the exploit requires remote local high‑privilege access and a specific configuration of the Open Query module, the overall risk is modest.

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62

The attack requires a high‑privilege local account on the PeopleSoft server; ordinary users are not at risk. The CVSS base score of 1.9, the EPSS score below 1 %, and the absence from CISA’s KEV catalog indicate a very low realistic exploitation probability. If a privileged account is compromised, the attacker can read sensitive but limited data, but cannot alter data, gain persistence, or affect service availability.