A vulnerability exists in the Updates Environment Mgmt component of Oracle PeopleSoft Enterprise PeopleTools that allows a high privileged local attacker who can log onto the underlying infrastructure to modify, insert, delete, or read data from the application, and to cause a partial denial of service. The flaw permits the attacker to bypass normal data access restrictions, compromising the confidentiality, integrity, and availability of the application data. The attack requires local host access and high privileges, so it is not exploitable remotely but can have significant impact for users with sufficient access.

The vulnerability affects Oracle Corporation PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63. The impacted component is the Updates Environment Mgmt feature. Users running these specific versions should verify whether they are using a patched release or a later, unaffected version.

The CVSS 3.1 Base Score of 4.2 indicates a medium severity with low confidentiality, integrity, and availability impact scores. The EPSS score of < 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV, suggesting limited publicly known exploitation. The required exploitation path is a local, high‑privilege attacker who has already logged into the infrastructure where PeopleSoft runs; no network‑to‑user interaction or elevated user privileges are necessary beyond local administrative access.