The flaw exists in the Security component of PeopleSoft Enterprise PeopleTools and permits a high‑privileged user with system log‑on to fully compromise the application. The vulnerability enables an attacker to gain complete control, jeopardizing confidentiality, integrity and availability. A local attacker must also present a human interaction from a user separate from the attacker to execute the exploit.

Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 are vulnerable.

The CVSS 3.1 base score of 6.5 indicates a moderate‑to‑high severity with full CIA impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation data. The attack vector is local (AV:L) with a low effort (AC:L) and high privileges (PR:H); the UI requirement (UI:R) means human interaction is needed. The risk remains significant for environments where privileged accounts have unfettered access to the infrastructure hosting PeopleSoft, making patching or other controls a critical priority.