This vulnerability in PeopleSoft Enterprise PeopleTools Data Mover allows a high-privileged attacker with infrastructure logon to compromise the product. Exploitation requires user interaction from a person other than the attacker and can affect additional products beyond PeopleTools. The impact includes unauthorized data manipulation and access, as well as partial denial of service. The CVSS vector indicates local attack vector, high attack complexity, high privileges required, user interaction required, scope change, and high confidentiality and integrity impact with low availability impact. Affected versions are 8.61 through 8.63 inclusive.

Exploitation can result in unauthorized creation, deletion, or modification of critical data and unauthorized access to all data accessible by PeopleSoft Enterprise PeopleTools. It can also cause a partial denial of service of the PeopleTools environment. The vulnerability affects confidentiality, integrity, and availability with the highest impact on confidentiality and integrity.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly. The vendor advisory emphasizes the importance of applying available patches without delay to prevent exploitation. No specific workaround or temporary fix is mentioned; patching is the recommended remediation.