EUVD-2026-24341
GHSA-6fj2-3r4w-jj8f
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Network-accessible HTTP vector confirmed; PR:H because a high-privileged account is explicitly required; no availability impact per description.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise HCM Absence Management product of Oracle PeopleSoft (component: Absence Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Absence Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Absence Management accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Absence Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
PeopleSoft Enterprise HCM Absence Management version 9.2 exposes a missing-authentication function (CWE-306) in its Absence Management component, accessible over HTTP by network-reachable, high-privileged attackers. Successful exploitation grants unauthorized read and write access to critical HR absence data - including creation, deletion, or modification of all data accessible within the component. No active exploitation has been confirmed (not in CISA KEV), EPSS is 0.03% (8th percentile), and no public proof-of-concept code has been identified, positioning this as a targeted risk rather than an opportunistic threat.
Technical ContextAI
PeopleSoft Enterprise HCM is Oracle's enterprise human capital management suite, and the Absence Management component handles leave and absence lifecycle workflows for HR operations. The root cause is CWE-306 (Missing Authentication for Critical Function), which indicates that one or more sensitive operations within the Absence Management module do not enforce the authentication or authorization checks expected for their sensitivity level. Despite the 'Authentication Bypass' tag, the CVSS vector specifies PR:H (high privileges required), suggesting the bypass may be more accurately characterized as an authorization bypass - a high-privileged user circumventing access controls to reach functions or data outside their intended permission scope rather than bypassing login entirely. The vulnerability is exposed over HTTP (network vector), consistent with PeopleSoft's web-tier architecture. The affected CPE is cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_hcm_absence_management:*:*:*:*:*:*:*:*, with only version 9.2 confirmed affected per Oracle and EUVD.
RemediationAI
Apply Oracle's Critical Patch Update (CPU) for April 2026, available via the Oracle Security Alerts page at https://www.oracle.com/security-alerts/cpuapr2026.html. Oracle CPUs are cumulative, so customers running PeopleSoft Enterprise HCM 9.2 should apply the full April 2026 CPU bundle. An exact patched release version beyond the CPU designation has not been independently confirmed from available data, so customers should consult My Oracle Support for the applicable patch ID. As a compensating control prior to patching, restrict network access to the PeopleSoft web tier so that only authorized internal network segments and known high-privileged user accounts can reach the Absence Management component - noting that this reduces attack surface but does not remediate the underlying authorization flaw. Additionally, audit high-privileged account assignments and enforce the principle of least privilege to limit the pool of accounts capable of triggering this vulnerability.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today