This vulnerability affects Oracle PeopleSoft Enterprise PeopleTools component Business Interlink in versions 8.61 through 8.63. It is easily exploitable by an attacker with low privileges and network access via HTTP. Successful exploitation can lead to unauthorized access to all PeopleSoft Enterprise PeopleTools accessible data and unauthorized modification of some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle’s September 2026 Critical Security Patch Update includes fixes for this vulnerability. The vendor strongly recommends applying patches without delay to prevent exploitation.

Exploitation can result in unauthorized access to critical and all accessible PeopleSoft Enterprise PeopleTools data, as well as unauthorized update, insertion, or deletion of some data. This compromises confidentiality and integrity of the affected systems. There is no reported impact on availability. The vulnerability affects multiple products due to scope change but is rooted in PeopleTools. No known exploits in the wild have been reported at this time.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 without delay. Oracle strongly recommends staying on actively supported versions and promptly applying security updates to mitigate this and other vulnerabilities. No alternative mitigations or workarounds are specified in the advisory.