This vulnerability in Oracle PeopleSoft Enterprise PT PeopleTools (Deployment Package component) affects versions 8.61 and 8.62. It allows unauthenticated remote attackers to exploit the system via HTTP to gain unauthorized access to critical data and to perform unauthorized data modification operations such as update, insert, or delete on some accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact and low integrity impact. Oracle has addressed this vulnerability in their June 2026 Critical Security Patch Update, which includes patches for PeopleSoft PeopleTools. Oracle strongly advises customers to apply these patches without delay to mitigate the risk. Workarounds such as blocking network protocols or restricting privileges may reduce risk temporarily but could disrupt application functionality.

Successful exploitation allows unauthenticated attackers with network access via HTTP to gain unauthorized access to critical data within PeopleSoft Enterprise PT PeopleTools and to perform unauthorized update, insert, or delete operations on some accessible data. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability reported. The vulnerability is rated high severity with a CVSS 3.1 score of 8.2.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these official patches promptly to remediate the vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users; however, these mitigations may disrupt normal application functionality. Patch status is confirmed by the vendor advisory. No indication of alternative fixes or that the issue is already mitigated without patching.