PeopleSoft PeopleTools CVE-2025-53063

Exploitation requires the attacker to (1) hold a valid low-privileged PeopleSoft Enterprise PeopleTools account (PR:L - not an anonymous external attacker), accessing the PIA Core Technology component over HTTP, and (2) induce a separate victim user to interact (UI:R), such as clicking an attacker-supplied link or viewing attacker-controlled content. Exploitation is therefore gated by needing valid credentials plus successful social engineering of a second human, and is limited to PeopleTools versions 8.60, 8.61, and 8.62; impact is capped at partial read and partial update/insert/delete of a subset of data, with no availability impact, though the scope change means effects may extend to additional connected products.

This is a moderate-severity, moderate-priority issue rather than an emergency. The CVSS 3.1 base score is 5.4 (MEDIUM) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N: network-reachable over HTTP and low attack complexity, but it requires an already-authenticated low-privileged account (PR:L) AND user interaction from a victim other than the attacker (UI:R). These two prerequisites meaningfully lower real-world exploitability. The scope change (S:C) plus UI:R combination - with Low Confidentiality and Low Integrity impact and No Availability impact - is the classic signature of a cross-site scripting / injection-style flaw, even though the supplied CWE is CWE-125 (out-of-bounds read) and a 'Buffer Overflow' tag is attached; these signals conflict and should be verified against the Oracle advisory. On the exploitation side, all signals point low: EPSS is 0.22% (12th percentile), there is no CISA KEV listing, and no public proof-of-concept was provided. Net: a high-value enterprise product but a capped-impact, interaction-and-auth-gated bug with no evidence of exploitation - patch on a normal Oracle CPU cycle, not as a fire drill.

An attacker with a low-privileged PeopleSoft account crafts a malicious request or link within the PIA Core Technology interface and lures a higher-context user (e.g., an administrator or another employee) into viewing or clicking it. When the victim interacts, the payload executes in their session context, allowing limited unauthorized read and modify/insert/delete access to some PeopleTools data, with potential spillover to additional products due to the scope change. No public exploit code was identified at time of analysis.