A flaw in the LDAP component of Oracle PeopleSoft Enterprise PeopleTools allows an attacker who has local access to the PeopleSoft server to modify or delete data and to read a subset of the data that the system can access. The impact is a loss of confidentiality and integrity for PeopleSoft‑accessible data, with no denial‑of‑service impact reported. The vulnerability is rated CVSS 3.1 Base Score 4.4, indicating it is moderate but still significant for protecting sensitive business information.

The affected product is Oracle PeopleSoft Enterprise PeopleTools, version range 8.61‑8.63. This includes all installed instances that include the LDAP component and support those specific releases.

The exploitation requires local or very low‑privileged access to the PeopleSoft infrastructure and no user interaction, making it a local attack vector. The EPSS score of <1% indicates a low likelihood of exploitation, while the CVSS score of 4.4 reflects a moderate risk; the vulnerability is not listed in the CISA KEV catalog. Because the attack can change or read data, it could be leveraged for further compromise or data exfiltration if combined with other weaknesses. The likely attack path is via a local attacker logging onto the PeopleSoft server or compromising an account with low privileges, then using the LDAP component to perform unauthorized modifications or reads.