PeopleSoft PeopleTools CVE-2025-53050

Exploitation requires network HTTP reachability to the PeopleSoft Enterprise PeopleTools Performance Monitor component on an affected version (8.60, 8.61, or 8.62); the Performance Monitor must be deployed/enabled and accessible to the attacker. No authentication, no credentials, and no user interaction are required (PR:N/UI:N), and complexity is low (AC:L), so default internet- or intranet-exposed instances are reachable targets. The primary limiting factor is exposure: environments where the Performance Monitor servlet is not network-accessible to untrusted clients (e.g., segmented behind access controls or not enabled) are not realistically exploitable. Impact is limited strictly to availability - no data disclosure or modification is possible.

This is an availability-only denial-of-service flaw (CVSS 3.1 7.5, CWE-400 uncontrolled resource consumption) in the Performance Monitor component of Oracle PeopleSoft Enterprise PeopleTools. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction, and impact is confined to availability (C:N/I:N/A:H, scope unchanged) - there is no confidentiality or integrity exposure and no code execution. Weighed against real-world exploitation signals, the picture is far less alarming than the 7.5 suggests: EPSS is only 0.43% (35th percentile), the CVE is NOT in CISA KEV, and no public exploit code is identified. So while the vulnerability is technically easy to trigger, the combined intelligence points to a low likelihood of active exploitation; the high base score is driven entirely by the ease-of-exploitation metrics applied to a complete-DOS outcome, not by confidentiality/integrity risk or evidence of in-the-wild abuse. Realistically this should be prioritized as a standard patch-cycle availability issue rather than an emergency, with elevated attention only where the Performance Monitor servlet is internet-exposed. Oracle is the sole source for affected versions and the fix; impact is self-reported and not independently corroborated by a third party.

An unauthenticated attacker with network HTTP access to a PeopleSoft Enterprise PeopleTools instance (versions 8.60-8.62) sends crafted requests to the Performance Monitor component, consuming resources until the application hangs or repeatedly crashes, producing a complete denial of service. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are needed. No public exploit identified at time of analysis, so an attacker would need to develop their own trigger.