PeopleSoft SCM Purchasing CVE-2026-34295

Exploitation requires possession of a valid, low-privileged PeopleSoft application account with HTTP network access to the PeopleSoft PIA web tier - unauthenticated exploitation is not possible per the PR:L CVSS metric. The vulnerable component is specifically the SCM Purchasing module within PeopleSoft 9.2; PeopleSoft deployments that do not include SCM Purchasing are not affected. No special OS platform, non-default configuration flag, or specific feature toggle beyond having the Purchasing module deployed and accessible is required. Exploitation is constrained by the need for at least one valid PeopleSoft account, meaning purely external, anonymous attackers cannot directly exploit this flaw. The risk is materially higher in environments where the PeopleSoft PIA interface is accessible from untrusted networks (e.g., internet-facing portals) or where many users hold low-privilege accounts, as either condition expands the feasible attacker population.

Multiple converging signals position this as a moderate severity issue with low near-term exploitation urgency. The CVSS 3.1 score of 6.5 reflects high confidentiality impact, but PR:L explicitly limits the attack surface to already-authenticated users, ruling out purely external unauthenticated exploitation. EPSS at 0.03% (9th percentile) indicates very low probability of widespread exploitation in the near term. SSVC classifies exploitation as 'none,' automatable as 'no,' and technical impact as 'partial' - consistent with a flaw that requires insider or compromised-credential access rather than opportunistic mass exploitation. No CISA KEV listing and no known public exploit code further reduce urgency. The 'Authentication Bypass' tag creates a minor tension with the PR:L CVSS metric - this is inferred to mean authorization bypass (horizontal or vertical privilege escalation within the application) rather than a bypass of the authentication gate itself; this distinction is not explicitly resolved in available advisory text. Organizations with sensitive procurement data, insider threat exposure, or internet-facing PeopleSoft deployments should treat this with higher priority than the EPSS score alone suggests.

An authenticated PeopleSoft user holding only a minimal application role - such as a purchasing clerk, a recently onboarded contractor, or an account compromised via credential phishing - sends crafted HTTP requests to Purchasing module endpoints, bypassing the authorization checks that should enforce role-based data boundaries. The attacker retrieves sensitive procurement records including vendor contracts, pricing schedules, and purchase order details without possessing the required elevated roles. No public exploit code has been identified, making this scenario currently reliant on manual crafting, but the low complexity (AC:L) indicates it would not be technically difficult for a motivated insider or attacker with obtained credentials.