EUVD-2026-24387
GHSA-2w37-mr53-59fv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-delivered over HTTP with low complexity; low privilege required per PR:L; only confidentiality impacted with no integrity or availability effects.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Maintenance Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Maintenance Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthorized read access to sensitive financial data is possible in Oracle PeopleSoft Enterprise FIN Maintenance Management 9.2 through an improper access control flaw (CWE-284) in the Work Order Management component. An authenticated low-privileged attacker with network access over HTTP can exploit this to gain complete access to all data within the PeopleSoft FIN Maintenance Management system. No public exploit exists and SSVC classifies exploitation as 'none,' with EPSS at 0.03% (9th percentile), indicating negligible opportunistic exploitation risk despite Oracle's own classification of the vulnerability as 'easily exploitable.'
Technical ContextAI
PeopleSoft Enterprise FIN Maintenance Management is Oracle's ERP module for financial maintenance operations, with the Work Order Management component handling asset maintenance workflows. The root cause is CWE-284 (Improper Access Control), meaning the application fails to correctly enforce authorization boundaries, allowing a lower-privileged principal to read data they should not have access to. The 'Authentication Bypass' tag in conjunction with PR:L suggests this is a horizontal or vertical privilege escalation within the authenticated session context - a low-privilege user bypasses access controls gating higher-privilege data within the Work Order Management interface. The CPE (cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_fin_maintenance_management:*:*:*:*:*:*:*:*) confirms Oracle as vendor and version 9.2 as the sole affected release. Exploitation occurs over HTTP (web-tier), consistent with PeopleSoft's browser-based PIA (PeopleSoft Internet Architecture) delivery model.
RemediationAI
Apply the Oracle Critical Patch Update released in April 2026, available at https://www.oracle.com/security-alerts/cpuapr2026.html. No exact patched version number is specified in available data - the Oracle CPU advisory should be consulted for the precise patch identifier and installation instructions. As compensating controls prior to patching, restrict network access to the PeopleSoft PIA web tier by IP allowlisting to known corporate networks, preventing opportunistic attackers from reaching the HTTP endpoint. Review and tighten role-based access control assignments within PeopleSoft to limit which users hold any privilege in the Work Order Management component, reducing the pool of accounts that could exploit this flaw. Enable PeopleSoft application-level audit logging on the Work Order Management component to detect anomalous data access patterns while the patch is pending. Restricting network access is the highest-value compensating control given AV:N, with the trade-off of potential disruption to remote or contractor access.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today