This vulnerability in Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 and 8.62) allows a low privileged attacker with logon access to the infrastructure to compromise PeopleTools. The attack can result in unauthorized creation, deletion, or modification of critical data within PeopleSoft Enterprise PeopleTools and may affect other related products due to scope change. The CVSS 3.1 vector indicates the attack requires local access (AV:L), high attack complexity (AC:H), low privileges (PR:L), no user interaction (UI:N), and impacts confidentiality and integrity with a scope change (S:C). Oracle has included this fix in its August 2026 Critical Security Patch Update, which contains 943 security patches across multiple products.

The vulnerability allows unauthorized modification and access to critical data within PeopleSoft Enterprise PeopleTools, potentially compromising the confidentiality and integrity of all accessible data. The scope change means that additional Oracle products integrated with PeopleSoft may also be affected. The attack requires local access with low privileges but is difficult to exploit due to high attack complexity. There is no indication of availability impact. No known exploits in the wild have been reported.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Staying on actively supported versions and applying Oracle patches without delay is recommended. No additional mitigation steps are specified by Oracle beyond patching.