EUVD-2026-24389Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
HTTP network access requires a valid low-privilege account; full contract data exposure yields C:H; zero integrity or availability impact confirmed by description.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise FIN Contracts product of Oracle PeopleSoft (component: Contracts). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Contracts. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Contracts accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthorized financial contract data disclosure in Oracle PeopleSoft Enterprise FIN Contracts 9.2 allows low-privileged authenticated users to access all contract records via HTTP without integrity or availability impact. The CWE-200 classification and 'Authentication Bypass' tag together suggest the flaw is an intra-session authorization control bypass - not a login bypass - permitting users to read contract data beyond their assigned permissions. No public exploit exists and EPSS sits at 0.03% (9th percentile), consistent with SSVC's 'Exploitation: none' assessment, though the high confidentiality impact to sensitive financial data warrants prompt patching for affected enterprises.
Technical ContextAI
PeopleSoft Enterprise FIN Contracts is a module within Oracle's PeopleSoft ERP suite used for financial contract lifecycle management, typically deployed in large enterprises and government entities. The vulnerability resides in the Contracts component and is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), a class of flaw where access control logic fails to enforce data-level permissions, allowing a principal to read records outside their authorized scope. The CPE string (cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_fin_contracts:*:*:*:*:*:*:*:*) with the EUVD-confirmed affected version 9.2 narrows the scope precisely. Although the tag 'Authentication Bypass' appears, the CVSS PR:L metric confirms a valid account is required, suggesting the bypass is at the authorization or row-level security layer - a common pattern in PeopleSoft where permission lists and data roles are misconfigured or incompletely enforced. The HTTP attack vector indicates exploitation targets the PeopleSoft web tier.
RemediationAI
Apply Oracle's April 2026 Critical Patch Update, published at https://www.oracle.com/security-alerts/cpuapr2026.html, which addresses this vulnerability in PeopleSoft Enterprise FIN Contracts 9.2. The exact patched release version is not specified in the available data and must be confirmed directly against Oracle's CPU release notes before deployment. If immediate patching is not possible, restrict network-level access to the PeopleSoft web tier to only authorized user network segments using firewall ACLs, reducing exposure to external or untrusted internal networks - note this does not eliminate risk from authorized insiders. Additionally, audit and tighten PeopleSoft row-level security, permission lists, and data role assignments within the Contracts component to enforce least-privilege data access; this may partially mitigate unauthorized data retrieval without requiring downtime, though it is not a substitute for the vendor patch. Monitor PeopleSoft application logs for anomalous contract data query volumes from low-privileged accounts as a detection compensating control.
Same weakness CWE-200 – Information Exposure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today