The 'high privileged attacker' requirement in this CVE isn't a mitigating factor—it's a diagnostic symptom. In PeopleSoft's permission model, PR:H encompasses a sprawling population of power users (team leads, HR administrators, financial approvers) who sit well below database admins but above basic employees. The privilege requirement doesn't narrow the attack surface; it reveals that PeopleSoft's architecture allows high-privilege operations through network-accessible HTTP paths. That's not a coding error—that's the platform's design.
What 'takeover' means matters here: PeopleCode runs on the application server, which then communicates with the database and potentially the OS layer through Oracle's integration stack. If this achieves arbitrary PeopleCode execution within the application server's context, proper OS-level privilege separation contains the blast radius. If it escapes to OS-level code execution, the application server's service account becomes the pivot point for everything. The CVE doesn't answer this, which means you can't assess containment boundaries without testing.
The version range (8.61-8.63) spans roughly 2019 to present. If your organization runs PeopleSoft, audit for forgotten instances provisioned for cancelled projects, sold divisions, or absorbed acquisitions—these often have stale, orphaned accounts with credentials that were never rotated. The privilege requirement becomes irrelevant when the credentials are orphaned.
More importantly: PeopleSoft rarely exists in isolation. It manages identity, connects to payroll systems, and often serves as an identity provider with OAuth/token trust relationships to downstream ERP and financial systems. Owning PeopleTools potentially means owning credential stores, personnel records, and pivoting to every system that trusts PeopleSoft tokens. Patch the application server by all means, but model the lateral movement to downstream systems—that's where the real blast radius lives. The 7.2 CVSS score measures impact to PeopleSoft itself; it says nothing about what it connects to.