What is the CVSS score of CVE-2026-34269?

CVE-2026-34269 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

PeopleSoft PeopleTools CVE-2026-34269

EUVD-2026-24344 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-j666-q429-qjc8

Authentication Bypass Oracle Peoplesoft Enterprise Peopletools

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Portal is network-accessible via HTTP with no attacker credentials needed; victim interaction required; scope change reflects impact on additional PeopleSoft modules beyond the Portal.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:29 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24344

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 6.1

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Improper access control (CWE-284) in the Portal component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 permits unauthenticated remote attackers to perform unauthorized data reads and writes against PeopleTools and connected downstream products, contingent on luring an authenticated user into triggering the vulnerable endpoint via HTTP. The CVSS vector pattern (AV:N/PR:N/UI:R/S:C) combined with the Authentication Bypass tag strongly suggests a client-side injection vector such as reflected XSS or CSRF that operates within the victim's session context. No public exploit code has been identified and CISA has not added this to the KEV catalog; EPSS of 0.03% (8th percentile) and SSVC Exploitation:none corroborate the absence of observed active exploitation at time of analysis.

Technical ContextAI

PeopleSoft Enterprise PeopleTools is Oracle's foundational development and runtime platform for PeopleSoft applications, with the Portal component providing the web-based navigation, homepage, and content aggregation layer served over HTTP. The CWE-284 (Improper Access Control) root cause indicates the Portal fails to enforce proper authorization boundaries for certain requests or rendered content. The scope change (S:C) in the CVSS vector means the flaw's impact escapes the Portal subsystem and can affect additional PeopleSoft application modules or data stores accessible through the authenticated user's session. Affected CPE: cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:* covering versions 8.61 and 8.62. The UI:R requirement is architecturally significant - the attack cannot be conducted without a victim performing an action, consistent with client-side injection patterns rather than direct server-side exploitation.

RemediationAI

Apply Oracle's April 2026 Critical Patch Update (CPU), available via the Oracle My Oracle Support portal; the advisory at https://www.oracle.com/security-alerts/cpuapr2026.html contains patch bundle instructions for PeopleSoft Enterprise PeopleTools 8.61 and 8.62. No exact fixed point release version is specified in the available data - the fix version should be confirmed directly from Oracle's patch readme or PeopleTools patch page before deployment. As a compensating control pending patching, restrict Portal component exposure by placing PeopleSoft web server nodes behind a reverse proxy or WAF configured to validate Referer and Origin headers, which can reduce the effectiveness of CSRF-style attacks. Additionally, enforcing strict Content Security Policy (CSP) headers on the PeopleTools web tier would mitigate reflected XSS vectors; however, PeopleSoft's Portal relies heavily on inline scripts, so CSP enforcement may break legitimate portal functionality and requires careful testing. Limiting internet-facing exposure of the PeopleSoft Portal and restricting access to internal networks or VPN is the most impactful near-term control with the fewest side effects.