CVE-2025-53065: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

A vulnerability has been identified in Oracle PeopleSoft Enterprise PeopleTools (component: PIA Core Technology) affecting versions 8.60, 8.61, and 8.62. This vulnerability was disclosed on October 21, 2025, and is tracked as CVE-2025-53065. The vulnerability allows unauthenticated attackers with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools, though successful exploitation requires human interaction from a person other than the attacker (Oracle Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4, indicating a medium severity level. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), which breaks down to: Network attack vector, Low attack complexity, No privileges required, User interaction required, Unchanged scope, with Low impact on both Confidentiality and Integrity, and No impact on Availability. The vulnerability has been classified under CWE-125 (Out-of-bounds Read) by CISA-ADP (NVD).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data, as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data (Oracle Advisory).

The vulnerability is considered easily exploitable but requires human interaction from someone other than the attacker. An unauthenticated attacker with network access via HTTP can potentially exploit this vulnerability (Oracle Advisory).

Oracle has released patches to address this vulnerability as part of their October 2025 Critical Patch Update. Users of affected PeopleSoft Enterprise PeopleTools versions (8.60, 8.61, and 8.62) are strongly advised to apply the security patches without delay (Oracle Advisory).