PeopleSoft HCM CVE-2026-34280

Exploitation requires an attacker to already hold high-privileged credentials within PeopleSoft Enterprise HCM Human Resources 9.2 (PR:H per CVSS), meaning this is not an unauthenticated attack. Access must be via the HTTP network interface, making this relevant in any network-reachable PeopleSoft deployment. The specific component involved is Job Profile Manager - deployments that have not deployed or have disabled this component may have a reduced attack surface, though this is not confirmed by available data. Exploitation is limited by the requirement for high-privilege HCM credentials; unauthenticated or low-privileged users cannot trigger the vulnerability. The SSVC 'Automatable: no' rating indicates that automated, mass exploitation is not feasible. The primary limiting factor is the PR:H requirement: threat actors without compromised admin credentials or insider access cannot exploit this remotely.

CVSS 3.1 rates this 6.5 (Medium), reflecting the PR:H requirement that limits the attack surface to already-privileged accounts - this substantially reduces real-world risk compared to unauthenticated flaws. EPSS is extremely low at 0.03% (8th percentile), consistent with no observed exploitation activity. KEV status is absent, and SSVC also records exploitation as 'none'. However, SSVC Technical Impact is 'total', acknowledging that successful exploitation yields complete confidentiality and integrity compromise of HCM data - a significant business risk in HR environments holding PII, compensation data, and employment records. SSVC 'Automatable: no' further confirms exploitation requires deliberate, targeted action rather than mass scanning. The CWE-306 tag combined with the 'Authentication Bypass' label introduces a nuance: while CVSS requires PR:H, the missing authentication for a critical internal function means a privileged insider or compromised admin account could escalate beyond their intended data access. Net assessment: low probability of opportunistic exploitation, but high consequence if a privileged insider or account takeover scenario applies. Organizations with strict HR data compliance requirements (GDPR, SOX) should prioritize this above the raw CVSS score suggests.

A malicious high-privileged insider or an attacker who has compromised a PeopleSoft HCM administrator account sends crafted HTTP requests to the Job Profile Manager component, invoking a critical function that fails to enforce authentication or authorization checks. The attacker can then exfiltrate the full set of HR data (compensation, personal records, job classifications) or tamper with job profile definitions affecting organizational hierarchy. No public exploit code has been identified at time of analysis, and exploitation requires pre-existing high-privilege access.