Oracle PeopleSoft Enterprise PeopleTools product has a vulnerability in the QAS component that allows an attacker without authentication to interact over HTTP and perform unauthorized update, insert or delete operations on data accessible through PeopleSoft. The flaw also enables a partial denial of service, impacting availability. The CVSS 3.1 base score of 6.5 indicates a moderate severity impact with limited confidentiality compromise but non‑zero integrity and availability effects.

Affected systems include Oracle Corporation PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63. These versions are listed as supported and vulnerable in Oracle’s advisory. Users deploying any of these releases should consider them at risk.

The vulnerability is exploitable over the network via HTTP by any unauthenticated entity, meaning an attacker with network access can trigger the flaw. The CVSS score of 6.5 reflects moderate exploitability, while the EPSS score is not available and the issue is not listed in CISA’s KEV catalog. The lack of a KEV listing and unknown EPSS suggest exploitation is possible but not yet confirmed in the wild. Nonetheless, because the flaw permits unauthorized data changes and service disruption, the risk to environments that expose QAS to the Internet or untrusted networks remains real.