This vulnerability in Oracle PeopleSoft Enterprise PeopleTools Process Scheduler affects versions 8.61 and 8.62. It enables a low privileged attacker with network access via HTTP to compromise the system, contingent on user interaction from someone other than the attacker. The attack can result in unauthorized creation, deletion, or modification of critical data, with a scope change that may impact other PeopleSoft products. The CVSS 3.1 base score is 8.7, reflecting high confidentiality and integrity impacts, with no availability impact. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly state patch availability or remediation level for these versions. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within PeopleSoft Enterprise PeopleTools and potentially other related products due to scope change. The confidentiality and integrity of data are highly impacted, while availability is not affected. This could result in significant compromise of sensitive information and system integrity.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for affected PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. Customers are strongly advised to review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation information and to apply any available security patches promptly. Until official patches are confirmed and applied, organizations should consider limiting network exposure of affected PeopleSoft components and enforce strict access controls. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.