The flaw resides in the Business Interlink component of Oracle PeopleSoft Enterprise PeopleTools. An unauthenticated attacker with network access over HTTP can exploit the defect, compromising the application. When successfully leveraged, the attacker can perform unauthorized updates, insertions, or deletions on data that should be protected, as well as read sensitive information, causing confidentiality and integrity loss. The weakness stems from insufficient authentication and authorization controls.

Oracle PeopleSoft Enterprise PeopleTools version 8.61 through 8.63, specifically the Business Interlink component, are affected. Organizations running these releases or any product that depends on or interacts with this component may be impacted due to the scope change noted in the advisory.

The CVSS v3.1 base score of 6.1 reflects moderate severity with moderate confidentiality and integrity impact. However, the exploit probability is low (EPSS < 1 %) and the vulnerability is not listed in CISA’s KEV catalog. Attackers require HTTP network access and a user‑interaction event from a person other than the attacker, which limits the feasibility of automated attacks. Nonetheless, a successful exploitation would grant an adversary the ability to alter or read protected business data.