This vulnerability affects Oracle PeopleSoft Enterprise PT PeopleTools Application Server versions 8.61 and 8.62. It permits an unauthenticated attacker with network access via HTTP to compromise the system, potentially resulting in full takeover. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The attack complexity is high, requiring network access but no privileges or user interaction. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes patches for PeopleSoft PeopleTools. Customers are strongly advised to apply these patches without delay to mitigate the risk. Until patches are applied, risk reduction may be possible by blocking required network protocols or limiting privileges, though these may affect functionality.

Successful exploitation can lead to complete compromise of PeopleSoft Enterprise PT PeopleTools, impacting confidentiality, integrity, and availability of the system. The vulnerability allows takeover by an unauthenticated attacker over the network via HTTP. This could result in unauthorized access, data disclosure, data manipulation, and service disruption.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or removing unnecessary privileges from users, though these measures may disrupt normal application functionality. Oracle strongly recommends staying on actively supported versions and applying security patches without delay.