A vulnerability exists in Oracle PeopleSoft Enterprise PeopleTools, specifically the Business Interlink component of versions 8.61 to 8.63. The flaw permits an attacker with low privileges who can reach the application over HTTP to read, insert, modify, or delete data that should be protected. Thus the impact includes high confidentiality damage and moderate integrity damage, with the potential to compromise all accessible PeopleSoft data.

Oracle Corporation PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are affected. The issue lies in the Business Interlink component and may also influence other Oracle PeopleSoft products when they rely on the same shared components.

The vulnerability carries a CVSS 3.1 base score of 8.5, indicating a high risk level, while the EPSS score is less than 1%, suggesting a low probability of exploitation at present. It is not listed in the CISA KEV catalog. The CVSS vector reveals a network attack vector (AV:N) with low attack complexity (AC:L) and low privilege requirement (PR:L), and no user interaction (UI:N). The scope changes (S:C) warn that exploitation could affect other products beyond the immediate application.