This vulnerability in Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 and 8.62) involves a security flaw that can be exploited remotely over HTTP by an attacker with low privileges. The attack requires user interaction from a third party and can result in unauthorized modification (update, insert, delete) and partial unauthorized reading of PeopleSoft accessible data. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity, with confidentiality and integrity impacts but no availability impact. The vendor advisory linked does not explicitly confirm the availability of a patch or remediation level at this time.

Successful exploitation can lead to unauthorized update, insertion, or deletion of some PeopleSoft Enterprise PeopleTools accessible data, as well as unauthorized read access to a subset of that data. This compromises the confidentiality and integrity of the affected system's data. The vulnerability does not impact system availability. The attack requires human interaction from a user other than the attacker, which limits exploitability to some extent.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions. Until a patch is released, consider limiting network exposure of PeopleSoft Enterprise PeopleTools and educating users to avoid interaction with suspicious content that could trigger exploitation.