This vulnerability affects Oracle PeopleSoft Enterprise PT PeopleTools versions 8.61 and 8.62 in the Performance Monitor component. It allows an unauthenticated attacker with network access over HTTP to compromise the system fully, resulting in complete takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can be executed remotely with low complexity, causing high confidentiality, integrity, and availability impacts. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes patches for PeopleSoft PeopleTools. Customers are strongly advised to apply these patches immediately to mitigate the risk. Workarounds such as blocking network protocols or limiting privileges may reduce risk but can disrupt application functionality.

Successful exploitation allows an unauthenticated remote attacker to fully compromise PeopleSoft Enterprise PT PeopleTools, leading to complete system takeover. This impacts confidentiality, integrity, and availability of the affected system, potentially allowing unauthorized data access, modification, and service disruption.

Oracle has released patches for this vulnerability in the June 2026 Critical Security Patch Update. Customers should apply these security patches without delay to remediate the vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by restricting privileges to necessary users only, though these measures may affect application functionality. Oracle strongly recommends remaining on actively supported versions and promptly applying all relevant patches.