This vulnerability in Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 to 8.63) allows an attacker with low privileges and logon access to the underlying infrastructure to compromise the PeopleTools environment. The flaw affects the SQR component and can lead to complete takeover of the PeopleTools system. The CVSS 3.1 vector indicates local attack vector with low complexity, requiring low privileges and no user interaction, resulting in high confidentiality, integrity, and availability impacts. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous security patches across multiple Oracle products.

Successful exploitation can result in complete compromise of the PeopleSoft Enterprise PeopleTools environment, impacting confidentiality, integrity, and availability of the system. The attacker requires only low privileged access to the infrastructure where PeopleTools runs. This could allow unauthorized control over PeopleTools, potentially leading to data breaches or disruption of services.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers should apply the relevant patches for PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 without delay. Oracle strongly recommends staying on actively supported versions and promptly applying security patches to mitigate this risk. No alternative mitigations or workarounds are specified in the advisory.