What is the CVSS score of CVE-2026-34280?

CVE-2026-34280 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

PeopleSoft HCM CVE-2026-34280

EUVD-2026-24358 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-04-21 oracle

GHSA-r8xp-m5j7-vp76

Authentication Bypass Oracle Peoplesoft Enterprise Hcm Human Resources Oracle Corporation

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable HTTP endpoint; PR:H reflects mandatory high-privilege credential requirement; no availability impact per vendor description.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:24 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24358

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Job Profile Manager). The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Human Resources accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Human Resources accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

PeopleSoft Enterprise HCM Human Resources 9.2 exposes critical HR data to unauthorized access and modification through a missing authentication control (CWE-306) in the Job Profile Manager component. High-privileged authenticated attackers with network HTTP access can read or modify all data accessible within the HCM module, including sensitive employee records and job profile configurations. No active exploitation is confirmed (CISA KEV absent, EPSS 0.03%), but the SSVC technical impact is rated 'total', indicating full data compromise potential upon successful exploitation.

Technical ContextAI

PeopleSoft Enterprise HCM Human Resources 9.2 (CPE: cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_hcm_human_resources:*:*:*:*:*:*:*:*) is Oracle's enterprise human capital management platform, delivered as a web application accessible over HTTP. The Job Profile Manager component handles structured HR data including competency models, job codes, and workforce profiles. The root cause is CWE-306 (Missing Authentication for Critical Function): within an already-authenticated session context, one or more critical functions in the Job Profile Manager fail to enforce adequate authentication or authorization checks before permitting data access or modification. This allows a high-privileged attacker to invoke restricted capabilities beyond their intended authorization boundary. The contradiction between PR:H (authenticated high-privilege required per CVSS) and CWE-306 (missing authentication for critical function) suggests the flaw is an intra-application authorization gap - authenticated high-privilege users can reach functions that should require additional authentication or role validation but do not.

RemediationAI

Apply Oracle's April 2026 Critical Patch Update (CPU), available via the Oracle support portal and announced at https://www.oracle.com/security-alerts/cpuapr2026.html. The CPU advisory should be consulted for the exact patched build number, as a specific fixed version number is not independently confirmed beyond Oracle's CPU reference. Until patching is complete, restrict access to the Job Profile Manager component by limiting network-level HTTP access to only authorized HR administrators - implement firewall or application-layer controls to reduce the pool of users who can reach this component. Additionally, review and audit high-privilege PeopleSoft HCM accounts to ensure principle of least privilege, removing unnecessary admin-level roles. Monitor PeopleSoft access logs for anomalous data reads or bulk modifications in job profile objects. Note that access restriction as a workaround does not eliminate the underlying authentication gap and should not substitute for patching.