The vulnerability resides in the Security component of PeopleSoft Enterprise PeopleTools 8.61 to 8.63. A low‑privileged user with access to the host running the application can exploit a flaw that allows unauthorized updates, inserts, or deletions of business data, as well as read access to restricted data and the ability to trigger a partial denial of service. The weaknesses involve improper access control, unauthorized modification of data (CWE-863) and information disclosure (CWE-200).

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are affected, specifically the Security component. No other versions or components are mentioned as vulnerable.

With a CVSS base of 4.5, the vulnerability has moderate severity, but the EPSS score of <1% indicates a low likelihood of exploitation currently. The flaw is not listed in CISA KEV. Attackers need local login credentials to the PeopleSoft host, meaning the attack vector is local with low privilege and no user interaction. Given the potential for data tampering and partial service disruption, systems holding sensitive business data should treat this as a significant concern.