PeopleSoft PeopleTools CVE-2025-61750

Requires a low-privileged but authenticated PeopleSoft account (PR:L) with network HTTP access to the PeopleTools Query component; no user interaction is needed. Exploitation is limited to the specific Query component in PeopleTools versions 8.61 and 8.62, and the impact is constrained to read-only disclosure of a subset of accessible data - it cannot modify data or affect availability. The authentication requirement is the primary limiting factor: an attacker must first obtain valid credentials, so internet-facing deployments with broad self-service account provisioning are at higher practical risk than tightly restricted internal instances.

This is a genuinely low-to-moderate priority issue, and the signals are largely consistent rather than conflicting. The CVSS 3.1 base score of 4.3 (MEDIUM) reflects a limited-impact flaw: AV:N means it is reachable over the network via HTTP, AC:L means exploitation is not technically difficult, but PR:L requires the attacker to already hold a low-privileged authenticated PeopleSoft account, UI:N means no victim interaction is needed, S:U means no scope change, and the impact is confined to C:L (partial unauthorized read) with no integrity (I:N) or availability (A:N) impact. The EPSS score of 0.29% (19th percentile) is low and aligns with the modest severity, indicating no measurable sign of imminent widespread exploitation. There is no CISA KEV listing (not actively exploited) and no public proof-of-concept identified, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied in the input, so automatable/technical-impact fields cannot be independently evaluated. The main caveat: the attack vector is network/authenticated, but the value of the flaw depends entirely on how many low-privileged accounts exist in a given deployment - in large PeopleSoft estates with many self-service users, a low-privilege foothold is realistic, which modestly raises practical concern above the raw score. Overall this is a patch-in-normal-cycle item, not an emergency.

An attacker who already possesses a valid low-privileged PeopleSoft account (e.g., a self-service employee or student login) sends crafted HTTP requests to the vulnerable Query component and retrieves a subset of PeopleSoft data they are not authorized to see. No public exploit code is known, and exploitation yields read-only disclosure with no ability to modify data or disrupt service.