What is the CVSS score of CVE-2026-34277?

CVE-2026-34277 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

PeopleSoft PeopleTools CVE-2026-34277

EUVD-2026-24352 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-gjr3-4mw2-xv4h

Denial Of Service Authentication Bypass Oracle Peoplesoft Enterprise Peopletools

6.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

vuln.today AI

6.6 MEDIUM

High privileges required to reach Fluid Core; scope change applies as adjacent PeopleSoft products are impacted; partial C/I/A impacts confirmed by description.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:26 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24352

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 6.6

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core). Supported versions that are affected are 8.61-8.62. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L).

AnalysisAI

Improper access control in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a high-privileged network attacker to perform unauthorized data reads, writes, and partial denial-of-service with scope change affecting adjacent PeopleSoft products. Despite a network-accessible attack vector and no user interaction required, exploitation is gated by the requirement for high-privilege credentials, and SSVC signals (exploitation: none, automatable: no) confirm no active exploitation at time of analysis. Oracle disclosed this through its April 2026 Critical Patch Update; no public exploit code has been identified.

Technical ContextAI

PeopleSoft Enterprise PeopleTools is Oracle's foundational development, runtime, and administration environment underpinning the full PeopleSoft application suite. The affected component - Fluid Core - is the modern responsive UI framework introduced in PeopleTools 8.54 and central to the end-user and administrator experience across 8.6x releases. The root cause is classified under CWE-284 (Improper Access Control), indicating that authorization logic within Fluid Core fails to adequately constrain what a high-privileged authenticated session can access or modify, enabling operations beyond the intended privilege boundary. The CVSS scope-change flag (S:C) reflects that exploitation of this access control failure in PeopleTools can propagate impact into other PeopleSoft application products sharing the same infrastructure. The CPE cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:* confirms this applies broadly across versions in the 8.61-8.62 range without sub-version exclusions noted. The 'Authentication Bypass' tag in the intelligence feed is potentially misleading given PR:H; it likely refers to the access control bypass (CWE-284) rather than a bypass of authentication itself.

RemediationAI

Apply the patches distributed as part of Oracle's Critical Patch Update for April 2026, available at https://www.oracle.com/security-alerts/cpuapr2026.html. Oracle does not publicly disclose exact patched version numbers in the advisory summary, so administrators should consult My Oracle Support (MOS) for the specific patch IDs applicable to their PeopleTools 8.61 or 8.62 installations. The patch data confirms a vendor-released fix exists; the exact remediated sub-version is not independently confirmed from available public sources. As a compensating control prior to patching, organizations should audit and restrict administrative account access to Fluid Core endpoints, enforce the principle of least privilege for PeopleTools admin roles, and monitor HTTP access logs for anomalous high-privilege session activity. Restricting network access to PeopleTools admin interfaces to trusted IP ranges reduces exposure without functional impact for most deployments. Note that scope-change exploitation affecting adjacent PeopleSoft applications means patching PeopleTools is necessary even if those downstream applications are considered lower risk individually.