This vulnerability in Oracle PeopleSoft Enterprise PeopleTools (nVision component) affects versions 8.61 to 8.63. It permits an unauthenticated attacker with network access via HTTP to compromise the product, contingent on user interaction by a third party. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges required, required user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability with a high severity score and included it in their August 2026 Critical Security Patch Update advisory.

An unauthenticated attacker with network access can exploit this vulnerability if a user other than the attacker interacts with the attack vector, potentially resulting in complete takeover of PeopleSoft Enterprise PeopleTools. The impact affects confidentiality, integrity, and availability at a high level, enabling full compromise of the affected system.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to affected versions 8.61 through 8.63 of PeopleSoft Enterprise PeopleTools. Oracle recommends remaining on actively supported versions and applying security patches without delay to mitigate this vulnerability. No indication of alternative mitigations or temporary fixes was provided.