The flaw in the Administer Workforce component of Oracle PeopleSoft Enterprise HCM Human Resources exposes a weakness that allows a high‑privilege attacker with HTTP network access to create, delete or modify critical data; it can also read privileged information and cause the application to hang or repeatedly crash. The CVE identifies this as a CWE‑200 information‑disclosure issue but the description makes it clear that the impact extends beyond simple disclosure to active data manipulation and availability denial. The vulnerability requires a human interaction from an user other than the attacker, meaning the attacker cannot complete the exploit unaided but can seize control once a legitimate user engages.

Oracle PeopleSoft Enterprise HCM Human Resources version 9.2, specifically the Administer Workforce module, is the only version reported as affected by the CNA. The product runs on HTTP services exposed to the network and no other versions are noted in the advisory.

The CVSS 3.1 base score of 6.0 indicates a moderate severity flaw. EPSS is reported as <1 %, suggesting a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Successful exploitation demands network HTTP access, elevated credentials, and the cooperation of a user willing to perform a seemingly benign action. If these conditions are met, the attacker can compromise confidentiality, integrity, and availability of the PeopleSoft system.