PeopleSoft HCM CVE-2026-22006

Exploitation requires an authenticated PeopleSoft HCM account with at least low-level privileges (PR:L confirmed by CVSS vector). The attacker cannot self-trigger the vulnerability - a separate victim user must actively interact with the attacker-influenced content over HTTP (UI:R), such as viewing a crafted employee record or following a malicious link within the application. The vulnerable component is specifically Employee Snapshot within PeopleSoft Enterprise HCM Human Resources version 9.2; no special non-default configuration is indicated as a prerequisite. Factors limiting exploitation: the attacker must already hold a valid HCM account, must socially engineer a victim into taking an action, and impacts are bounded at C:L/I:L with no availability impact. The SSVC 'Automatable: no' assessment confirms mass exploitation is not feasible due to the mandatory human interaction step.

The CVSS 3.1 score of 5.4 is primarily elevated by the scope change (S:C), but real-world risk is moderate-to-low. The mandatory human interaction requirement (UI:R) and scope change pattern are consistent with a stored or reflected XSS in an HR data view - not an unauthenticated remote code execution. EPSS at 0.03% (8th percentile) confirms negligible automated exploitation probability. SSVC reinforces this: Exploitation=none, Automatable=no (UI:R prevents automation), Technical Impact=partial (limited C:L/I:L, no availability). No CISA KEV listing and no reported POC further reduce urgency. The CVSS AV:N/AC:L ratings sound alarming but are tempered by PR:L (authenticated attacker only), UI:R (requires victim action), and impact ceiling of C:L/I:L. This is a real vulnerability warranting patching under normal patch cycles, but not an emergency-priority issue for most organizations - unless PeopleSoft HR data sensitivity (e.g., salary, PII, compensation records accessible via Employee Snapshot) elevates the business risk beyond the raw CVSS score.

An attacker with a low-privileged PeopleSoft HCM account crafts a malicious payload - such as an injected script or link - targeting the Employee Snapshot component, then induces a higher-privileged HR user or administrator to interact with it (e.g., by opening a shared employee record or clicking a crafted URL). Upon victim interaction, the attacker gains unauthorized read access to a subset of HR data viewable by the victim and can perform limited unauthorized insert, update, or delete operations, with potential spillover to other PeopleSoft products sharing the same session or origin context due to scope change.