A local attack on PeopleSoft Enterprise PeopleTools can allow a low‑privileged user to read limited data that the application holds. The flaw resides in the XML Publisher component and is described as an easily exploitable vulnerability that, when triggered, compromises the confidentiality of PeopleSoft data. It does not impact integrity or availability and affects only the Confidentiality dimension of the application.

Oracle PeopleSoft Enterprise PeopleTools versions 8.61, 8.62, and 8.63 are affected. The vulnerability is present in the XML Publisher component of these releases.

The CVSS 3.1 base score of 3.3 indicates a low severity issue with local attack and low privilege required. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation is not yet documented. An attacker would need to be authenticated on the same infrastructure that runs PeopleSoft and could exploit the misconfiguration to read data that should be protected. Given the low privilege requirement, the attack vector is likely internal or compromised network access. The risk level remains low to moderate, but mitigations are still recommended to prevent potential data exposure.