What is the CVSS score of CVE-2026-34295?

CVE-2026-34295 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

PeopleSoft SCM Purchasing CVE-2026-34295

EUVD-2026-24382 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-c9q5-q8r3-8m2c

Authentication Bypass Oracle Peoplesoft Enterprise Scm Purchasing Oracle Corporation

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible HTTP endpoint requires low-privilege authentication (PR:L); pure read-only data disclosure maps to C:H with I:N and A:N; no scope change as impact stays within the Purchasing module.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:19 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24382

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Purchasing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Purchasing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

PeopleSoft Enterprise SCM Purchasing 9.2 exposes critical procurement data to low-privileged authenticated attackers over HTTP, enabling complete unauthorized read access to all data within the Purchasing module. The flaw is rooted in improper access control (CWE-284), allowing a low-privileged PeopleSoft account holder to bypass post-authentication authorization restrictions and retrieve sensitive purchasing records they should not have access to. No public exploit code exists and EPSS sits at a very low 0.03%, but Oracle's April 2026 Critical Patch Update addresses the vulnerability and should be applied to any internet-facing or multi-tenant PeopleSoft deployment.

Technical ContextAI

Oracle PeopleSoft is a large-scale enterprise resource planning (ERP) suite used in higher education, government, and Fortune-class organizations. The SCM Purchasing component manages procurement workflows - purchase orders, vendor data, contracts, and pricing - over HTTP via PeopleSoft's PIA (PeopleSoft Internet Architecture) web layer. CWE-284 (Improper Access Control) indicates the application fails to enforce authorization boundaries after a user has authenticated: a user holding a minimal role can query data objects or API endpoints in the Purchasing module without the system validating their role-based entitlements. The CPE cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_scm_purchasing identifies Oracle's PeopleSoft SCM Purchasing as the specific affected application. Despite the 'Authentication Bypass' tag in the intelligence data, the PR:L CVSS metric confirms authentication is a prerequisite - the bypass refers to intra-application authorization controls, not the login mechanism itself.

RemediationAI

Apply Oracle's April 2026 Critical Patch Update, which addresses CVE-2026-34295 in PeopleSoft Enterprise SCM Purchasing 9.2; the advisory is at https://www.oracle.com/security-alerts/cpuapr2026.html. The exact patched sub-version is not independently confirmed from available data - consult the CPU directly for the specific patch ID and installation instructions. If immediate patching is not possible, restrict network-layer access to the PeopleSoft PIA web tier to only authorized IP ranges or VPN segments, reducing the pool of potential low-privileged account holders who can reach the Purchasing endpoints over HTTP. Additionally, audit and enforce least-privilege RBAC assignments within PeopleSoft SCM Purchasing, revoking unnecessary role memberships and ensuring purchasing data roles are granted only to explicitly authorized users - this limits blast radius until the patch is applied. Note that network segmentation alone does not eliminate insider threat risk.