This vulnerability affects Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 in the Cube Manager component. It permits a low privileged attacker with network access over HTTP to exploit the system, leading to unauthorized modification of critical data or causing a denial of service by hanging or crashing the application. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on integrity and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains targeted security fixes for multiple products including PeopleSoft Enterprise PeopleTools.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data within PeopleSoft Enterprise PeopleTools, compromising data integrity. Additionally, it can cause the application to hang or crash repeatedly, resulting in a complete denial of service. There is no confidentiality impact reported. The vulnerability requires network access via HTTP and low privileges, making it relatively easy to exploit.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying patches without delay. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified in the advisory.