This vulnerability affects Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 in the SQR component. It is exploitable remotely by an attacker with low privileges and network access over HTTP. Successful exploitation can lead to unauthorized access to critical or all accessible PeopleSoft data and can cause the application to hang or crash repeatedly, resulting in a complete denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple products. Customers are strongly advised to apply the relevant patches promptly to mitigate this risk.

Exploitation of this vulnerability can result in unauthorized access to sensitive or all accessible data within PeopleSoft Enterprise PeopleTools and can cause a complete denial of service by hanging or crashing the application. This compromises confidentiality and availability of the affected system.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 without delay to remediate this vulnerability. Oracle strongly recommends staying on actively supported versions and promptly applying security patches to prevent exploitation.