This vulnerability affects Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 in the Charting component. It is exploitable remotely over HTTP by an attacker with low privileges, but requires user interaction from a third party. Exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible through PeopleSoft Enterprise PeopleTools. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impact without availability impact. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous security patches across many products. The advisory strongly recommends applying patches promptly to mitigate this and other vulnerabilities.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within PeopleSoft Enterprise PeopleTools, or unauthorized access to all accessible data in the product. This compromises confidentiality and integrity of sensitive information. The vulnerability does not impact availability. The attack requires user interaction by a person other than the attacker, and the attacker must have network access and low privileges.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches for PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 without delay. No indication was given that the vulnerability is mitigated by default or that no action is required. Patch status is confirmed by the vendor advisory. Organizations should follow Oracle's official patch installation instructions to remediate this vulnerability.