The vulnerability is in the nVision component of Oracle PeopleSoft Enterprise PeopleTools. An attacker with low privileges and network access via HTTP can exploit an insufficient access control mechanism to read sensitive data. The flaw impacts confidentiality only; integrity and availability remain unaffected.

Affected software includes Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63. The nVision component in these releases is susceptible when not patched. Exposed HTTP endpoints that serve payroll, financial, or other content can be targeted by a remote user. Compromise is limited to data accessible through PeopleSoft.

With a CVSS 3.1 Base Score of 6.5 the vulnerability is moderate, focusing on confidentiality damage. The EPSS score of < 1% indicates a very low probability of exploitation, and the entry is not listed in the CISA KEV catalog. The attack vector is remote network access over HTTP, indicating that an attacker reaching the nVision interface can retrieve data without advanced privileges. The description does not specify whether the site is publicly reachable; based on the description, it is inferred that if the site is publicly reachable, the potential for unauthorized data exfiltration remains high.