Oracle PeopleSoft PeopleTools CVE-2025-53061

Exploitation requires an attacker who already possesses HIGH privileges within PeopleSoft Enterprise PeopleTools (per CVSS PR:H) and network access to the PIA Core Technology web interface over HTTP; no user interaction is needed (UI:N). Only versions 8.60, 8.61, and 8.62 are affected. The principal limiting factor is the high-privilege prerequisite, which confines realistic exploitation to malicious insiders or attackers who have already compromised a privileged account rather than anonymous external actors. The aggravating factor is the scope change (S:C): successful attacks can affect additional products beyond PeopleTools. Impact is bounded to Low confidentiality (read of a data subset) and Low integrity (unauthorized insert/update/delete of some data), with no availability impact.

This is a moderate-severity access-control flaw (CWE-284) in Oracle PeopleSoft Enterprise PeopleTools PIA Core Technology, rated CVSS 3.1 5.5 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N). The signals are largely consistent and point AWAY from urgent, widespread risk: the attack is network-borne over HTTP with low complexity, but critically requires PR:H - the attacker must already hold high privileges on the target, which sharply limits the realistic attacker population to insiders or already-compromised privileged accounts. EPSS corroborates low near-term exploitation likelihood at 0.25% (15th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis, so this is no public exploit identified at time of analysis. The notable amplifier is the scope change (S:C): Oracle states attacks 'may significantly impact additional products,' meaning a compromise of PeopleTools can reach beyond its own security boundary even though the direct C/I impacts are only Low and availability is unaffected. A clear data conflict exists: the input Tag 'Authentication Bypass' contradicts the CVSS vector's PR:H (high-privilege prerequisite) - a true authentication bypass would imply PR:N, so the tag appears mislabeled and should not be used to upgrade urgency. Net assessment: a real but lower-priority issue best handled on the normal Oracle CPU patch cadence, not an emergency; prioritize higher if the environment grants broad high-privilege PeopleTools access or if adjacent integrated products are sensitive.

An attacker who already holds a high-privileged PeopleTools account (or has hijacked one) sends crafted HTTP requests to the PIA Core Technology interface, abusing improper access control to read a subset of data and perform unauthorized insert/update/delete operations. Because of the scope change, the impact can extend into additional integrated Oracle products beyond PeopleTools itself. No public exploit code was identified, and exploitation depends on the attacker first obtaining elevated privileges.