This vulnerability affects Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 in the Install and Packaging component. It allows an unauthenticated remote attacker with network access via HTTP to compromise the system, leading to unauthorized creation, deletion, or modification of critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impacts. The vulnerability is classified under CWE-284 (Improper Access Control) and CWE-306 (Missing Authentication for Critical Function). Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation details for it.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible through PeopleSoft Enterprise PeopleTools. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability is difficult to exploit and requires network access via HTTP but no authentication.

Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among many others but does not explicitly confirm patch availability for this specific issue. Customers are strongly advised to remain on actively supported versions and apply Oracle security patches promptly as they become available. Patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance.