PeopleSoft Project Costing CVE-2026-34306

Exploitation requires a valid low-privileged user account within the PeopleSoft Enterprise environment and network access to the PeopleSoft HTTP interface, confirmed by CVSS AV:N/PR:L. The vulnerability is specific to version 9.2 of the FIN Project Costing module, Projects component - other PeopleSoft modules or versions are not confirmed affected. No user interaction from a victim is required (UI:N). Limiting factors: an attacker must already hold authenticated credentials to the PeopleSoft environment, which constrains the threat to insider-threat actors, compromised accounts, or attackers who have previously obtained valid credentials through phishing or credential stuffing. SSVC Automatable: no further indicates the exploit cannot be trivially mass-deployed without application-specific reconnaissance.

The CVSS 3.1 base score of 6.5 (Medium) reflects a network-accessible, low-complexity attack requiring only low-privileged credentials with high confidentiality impact but no integrity or availability impact. This is consistent with a data-exposure-only flaw. However, multiple signals converge to indicate low real-world urgency: EPSS at 0.03% (9th percentile) suggests the vulnerability is not currently being exploited at scale or observed in attack telemetry; SSVC assessment confirms Exploitation: none and Automatable: no, meaning adversaries cannot trivially chain this into automated campaigns; Technical Impact is rated partial by SSVC, acknowledging bounded scope. There is no CISA KEV listing and no reported POC. The primary risk is insider-threat or compromised low-privileged account scenarios where an attacker harvests sensitive financial project data. The 'Authentication Bypass' tag introduces a mild ambiguity - if this were truly pre-authentication, the CVSS vector would be PR:N rather than PR:L; defenders should verify with Oracle's advisory whether any unauthenticated path exists, though current data does not support that claim.

An attacker with a low-privileged PeopleSoft account - such as a contractor, auditor, or compromised employee credential - sends a crafted HTTP request to the Projects component endpoint, exploiting a missing or improperly enforced authorization check to access financial project costing data beyond their assigned scope. The attacker can enumerate and exfiltrate all data accessible to the FIN Project Costing module, including budget figures, cost allocations, and project financial records. No public proof-of-concept exists at this time, and the SSVC assessment of Automatable: no suggests the attack requires some application-specific knowledge to execute.