This vulnerability affects Oracle PeopleSoft Enterprise PeopleTools (Portal component) versions 8.61-8.62. It is exploitable remotely over HTTP without authentication but requires user interaction from a third party. The vulnerability allows unauthorized modification (update, insert, delete) and unauthorized reading of some accessible data within PeopleSoft Enterprise PeopleTools. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, low confidentiality and integrity impact, and no availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle’s April 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state that a patch is available for PeopleSoft Enterprise PeopleTools. Customers are advised to review Oracle advisories and apply patches promptly when available.

Successful exploitation can result in unauthorized read and modification (update, insert, delete) of some PeopleSoft Enterprise PeopleTools accessible data. The scope change indicates that additional Oracle products beyond PeopleTools may be impacted. The vulnerability does not affect system availability. No known active exploits have been reported. The medium severity rating and CVSS score of 6.1 reflect moderate risk primarily to confidentiality and integrity of data.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly when patches become available. Until a patch is applied, organizations should consider limiting network exposure of affected PeopleSoft Enterprise PeopleTools versions and exercising caution with user interactions that could trigger exploitation. No vendor advisory states that no action is required or that the issue is already mitigated.