What is the CVSS score of CVE-2026-22006?

CVE-2026-22006 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

PeopleSoft HCM CVE-2026-22006

EUVD-2026-24309 MEDIUM

Information Exposure (CWE-200)

2026-04-21 oracle

GHSA-w6p7-5x7m-cr7c

Information Disclosure Oracle Peoplesoft Enterprise Hcm Human Resources Oracle Corporation

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-exploitable HTTP web app requiring low-privilege auth and victim interaction; scope change and C:L/I:L impact consistent with client-side injection; no availability impact described.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:36 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24309

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 5.4

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Employee Snapshot). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise HCM Human Resources, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Human Resources accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise HCM Human Resources accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Cross-site scripting or equivalent client-side injection in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 - specifically the Employee Snapshot component - enables a low-privileged authenticated attacker to compromise confidentiality and integrity of HR data and trigger a scope change affecting additional products, provided a victim user interacts with attacker-controlled content over HTTP. The CVSS 3.1 score is 5.4 Medium (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting the scope change that elevates impact beyond the directly vulnerable system. No public exploit code exists and EPSS is 0.03% (8th percentile), indicating very low likelihood of opportunistic exploitation at time of analysis.

Technical ContextAI

Oracle PeopleSoft Enterprise HCM (Human Capital Management) Human Resources is an enterprise-grade web-based HR management platform used by large organizations globally. The affected component, Employee Snapshot, provides a consolidated view of employee data. The CPE identifier (cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_hcm_human_resources:*:*:*:*:*:*:*:*) confirms Oracle as vendor with version 9.2 as the affected release. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates the root cause class is improper access control or data leakage. The CVSS scope change flag (S:C) combined with an HTTP attack vector and UI:R strongly suggests a client-side injection vulnerability such as cross-site scripting (XSS) or content injection within the Employee Snapshot web interface, where attacker-supplied content executes in a victim's browser session and can cross origin or application boundaries to impact related PeopleSoft components.

RemediationAI

Apply Oracle's April 2026 Critical Patch Update (CPU), documented at https://www.oracle.com/security-alerts/cpuapr2026.html. Oracle CPUs are cumulative; customers should apply the full patch set rather than cherry-picking individual fixes. The exact patched version number is not independently confirmed beyond the CPU advisory reference - consult Oracle support or My Oracle Support (MOS) for specific patch IDs targeting PeopleSoft HCM 9.2 Employee Snapshot. As a compensating control prior to patching, restrict access to the Employee Snapshot component to the minimum set of authenticated users via PeopleSoft role-based security, which reduces the pool of potential low-privileged attackers. Additionally, enforcing Content Security Policy (CSP) headers at the web/application tier can limit the exploitability of XSS-class vulnerabilities in PeopleSoft's PIA web layer. Note that CSP alone does not eliminate the vulnerability and should not be treated as a permanent substitute for patching.