This vulnerability affects Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63, specifically in the Integration Broker component. It permits a low-privileged attacker with network access over HTTP to exploit the flaw, leading to unauthorized modification of critical or all accessible PeopleSoft data. The vulnerability has a CVSS 3.1 score of 7.7 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, no confidentiality impact, high integrity impact, and no availability impact. Oracle's September 2026 Critical Security Patch Update addresses this and many other vulnerabilities, providing official fixes.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within PeopleSoft Enterprise PeopleTools, potentially affecting additional Oracle products due to scope change. The integrity of the data is compromised, but confidentiality and availability are not directly impacted according to the CVSS vector. This could result in significant operational and data integrity issues for affected organizations.

Oracle has released an official fix for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are strongly advised to apply the relevant patches promptly. Oracle recommends remaining on actively supported versions and applying security patches without delay to mitigate exploitation risks. No alternative mitigations or workarounds are specified in the advisory.