The vulnerability resides in the Report Distribution component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63. It is an information‑exposure flaw (CWE‑200) that permits unauthenticated HTTP requests to retrieve sensitive data from the application. Although the flaw is considered difficult to exploit, a successful attack could provide an attacker with complete access to all data made available through PeopleSoft Enterprise PeopleTools, directly impacting confidentiality and potentially enabling further escalation.

Affected products are Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63. The scope change noted in the advisory indicates that any Oracle product using the same Report Distribution functionality may also be impacted, so administrators should review all related components.

The CVSS 3.1 base score of 6.8 signals a moderate risk primarily to confidentiality. EPSS is below 1 %, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low likelihood of public exploitation. The attack requires network access over HTTP with no authentication and benefits from a successful exploitation that changes the scope to other database objects or applications. Organizations should therefore address the vulnerability promptly through patching or network‑level controls.