This vulnerability affects Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 and involves a security flaw in the product's security component. It is exploitable over the network via HTTP by an attacker with low privileges, requiring user interaction from a third party. Exploitation can lead to unauthorized modification (update, insert, delete) and limited unauthorized reading of accessible data within PeopleTools. The vulnerability also causes a scope change, potentially affecting other Oracle products. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, scope changed, and partial confidentiality and integrity impacts. Oracle’s July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly state patch availability or remediation details for PeopleTools 8.61 and 8.62.

Successful exploitation can result in unauthorized update, insert, or delete access to some PeopleSoft Enterprise PeopleTools accessible data and unauthorized read access to a subset of that data. The vulnerability requires user interaction and low attacker privileges but can lead to a scope change affecting additional Oracle products. The CVSS score of 5.4 indicates a medium impact primarily on confidentiality and integrity, with no impact on availability.

Oracle’s July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation for PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. Patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions. Until a patch is confirmed, limit exposure by restricting network access to PeopleTools HTTP interfaces and exercising caution with user interactions that could trigger exploitation.