This vulnerability affects Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 in the Business Interlink component. It permits an unauthenticated attacker with network access over HTTP to compromise the PeopleTools environment, potentially resulting in full takeover. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes for this and many other vulnerabilities.

Successful exploitation can lead to complete compromise of PeopleSoft Enterprise PeopleTools, impacting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected environment remotely without authentication. However, the vulnerability is described as difficult to exploit, and attack complexity is high.

Oracle has released patches for this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected versions (8.61 through 8.63). Oracle recommends remaining on actively supported versions and applying security patches without delay to mitigate this and other vulnerabilities. No alternative mitigations or workarounds are specified in the advisory.