Oracle PeopleSoft CVE-2025-61762

Exploitation requires a valid low-privileged PeopleSoft account on the target (PR:L) with network HTTP access to the PeopleSoft Enterprise FIN Payables (Payables) component of Oracle PeopleSoft version 9.2; no user interaction is needed (UI:N). The key limiting factor is the authentication requirement - this cannot be exploited by an unauthenticated attacker, which substantially narrows the realistic threat to insiders or attackers who have already obtained low-tier credentials. Impact is further bounded to a subset of Payables-accessible data and a partial (not full) denial of service.

This is a moderate, non-priority issue for most organizations despite its network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw, but the PR:L requirement means an attacker must already hold a valid low-privileged PeopleSoft account - this is not an unauthenticated internet-facing bug. Impact is explicitly limited: C:L/I:L/A:L with scope unchanged (S:U), and Oracle's own wording ('some' data, 'a subset' of data, 'partial' DoS) reinforces that this grants partial, not total, compromise. The EPSS score of 0.20% (9th percentile) is low, and there is no CISA KEV listing and no public exploit identified, so all exploitation signals point to low real-world urgency. The signals are internally consistent - there is no network-vs-local contradiction here. One metadata conflict should be noted: the input carries an 'Authentication Bypass' tag, but both the CVSS vector (PR:L) and the description ('low privileged attacker') indicate authentication is REQUIRED, not bypassed; the tag appears mislabeled and should not drive risk decisions. Net: a genuine authenticated access-control weakness worth patching in the regular Oracle CPU cycle, not an emergency.

An attacker who already possesses low-privileged credentials to a PeopleSoft FIN Payables instance (e.g., a limited internal user or a compromised low-tier account) sends crafted HTTP requests to the Payables component to read, modify, insert, or delete a subset of accessible financial data beyond their authorized scope, or to trigger a partial denial of service. No public proof-of-concept exploit code has been identified at the time of analysis, and user interaction is not required (UI:N).