EUVD-2026-24333Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-accessible via HTTP with low-privilege auth required; victim interaction mandatory; scope change to adjacent components; no availability impact confirmed.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft (component: Person Search). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Shared Components. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise HCM Shared Components, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Shared Components accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise HCM Shared Components accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
AnalysisAI
Improper access control in the Person Search component of Oracle PeopleSoft Enterprise HCM Shared Components 9.2 enables an authenticated low-privileged attacker to compromise confidentiality and integrity of HCM data, with scope change indicating the impact extends to additional PeopleSoft products beyond the vulnerable component. Exploitation requires human interaction from a victim other than the attacker, consistent with a client-side injection pattern. No public exploit or KEV listing is present, and EPSS at 0.03% (8th percentile) with SSVC exploitation status of 'none' confirms low real-world exploitation activity at time of analysis.
Technical ContextAI
The vulnerability resides in the Person Search component of Oracle PeopleSoft Enterprise HCM Shared Components version 9.2, identified via CPE cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_hcm_shared_components:*:*:*:*:*:*:*:*. CWE-284 (Improper Access Control) is the root cause class, indicating that the application fails to properly enforce access restrictions on data or operations accessible through the Person Search interface. The CVSS scope change metric (S:C) combined with required user interaction (UI:R) and partial confidentiality and integrity impacts is characteristic of a cross-site or stored injection vector where a low-privileged user can craft malicious input that, when rendered or processed by another user's session, enables unauthorized data reads and writes across component boundaries within the PeopleSoft application suite. The 'Authentication Bypass' tag reported by the intelligence source suggests the access control failure allows a low-privileged principal to reach data or operations normally gated to higher-privilege roles.
RemediationAI
Apply the patch provided in Oracle's Critical Patch Update for April 2026, available at https://www.oracle.com/security-alerts/cpuapr2026.html. Oracle does not typically publish standalone patch versions outside the CPU mechanism; customers should consult My Oracle Support and apply the relevant CPU patch bundle for PeopleSoft Enterprise HCM 9.2. Until patching is complete, consider restricting access to the Person Search component to trusted internal network segments only, reducing the network-accessible attack surface (trade-off: this may disrupt self-service HR workflows for remote users). Additionally, enforce role-based access controls to ensure only appropriately privileged users can access Person Search functionality, limiting the pool of potential attackers. Monitor PeopleSoft application logs for anomalous Person Search queries or unexpected data modification events as a detection compensating control. No patch version number is independently confirmed beyond the April 2026 CPU reference.
Vulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft (component: Person Search)
Vulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft (component: Text Catalog).
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today