A vulnerability in the Security component of Oracle PeopleSoft Enterprise PeopleTools allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data. The weakness stems from improper information disclosure (CWE-200) and authentication bypass (CWE-306), and can be exploited without credentials to read, update, insert, or delete data. This leads to confidentiality compromise and potential integrity violations.

Oracle Corporation’s PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are affected. The issue resides in the Security component of the PeopleSoft application stack.

The attack vector is a network-based HTTP request, requiring no authentication and no special privileges. While the description notes that exploitation is difficult, the existence of the flaw could still be leveraged by determined attackers to compromise data within the affected PeopleSoft environments. The EPSS score of 0.00271 indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog; however, the CVSS score of 6.5 indicates a significant risk for organizations that rely on PeopleSoft for critical business processes.