Vulnerability in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools permits a local, low‑privileged attacker who can log on to the system hosting the application to compromise PeopleSoft Enterprise PeopleTools. This is a CWE‑200 information exposure flaw that allows the attacker to read a subset of data that the application exposes, thereby affecting confidentiality.

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are affected. All installations of these versions running the Updates Environment Management component are potentially vulnerable.

The CVSS 3.1 base score of 2.5 indicates a low‑to‑moderate risk. Exploitation requires a local attacker with limited privileges and is difficult. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. Attackers would need to compromise the PeopleSoft application to read protected data, so the impact is confined to confidentiality and does not extend to integrity or availability.