EUVD-2026-24401Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable HTTP, low complexity, requires authenticated low-privileged account (PR:L), confidentiality-only impact with no integrity or availability consequence.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise FIN Project Costing product of Oracle PeopleSoft (component: Projects). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Project Costing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Project Costing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthorized full data disclosure in PeopleSoft Enterprise FIN Project Costing 9.2 allows a low-privileged authenticated attacker to read all data accessible to the Projects component via a network-reachable HTTP endpoint. The root cause is improper access control (CWE-284), tagged by Oracle as an authentication bypass - most likely an authorization boundary failure that permits privilege escalation within the application rather than a bypass of the initial login gate, consistent with a PR:L CVSS vector. No public exploit code has been identified and EPSS is 0.03% (9th percentile), indicating negligible automated exploitation activity at this time.
Technical ContextAI
PeopleSoft Enterprise FIN Project Costing is the Oracle PeopleSoft ERP module responsible for financial project tracking, budget management, and cost allocation. The affected component is 'Projects,' a server-side subsystem accessed over HTTP. The root cause is classified as CWE-284 (Improper Access Control), which covers missing or incorrectly enforced authorization checks - the application fails to verify that a legitimately authenticated low-privileged user is restricted to only their authorized data scope. The CPE cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_fin_project_costing:*:*:*:*:*:*:*:* confirms this is Oracle-published software with a defined application footprint. The 'Authentication Bypass' tag from the intelligence feed likely refers to horizontal or vertical access control bypass within the authenticated session rather than pre-authentication exploitation, as the CVSS vector explicitly requires PR:L (low privilege credential).
RemediationAI
Apply the Oracle Critical Patch Update for April 2026, available at https://www.oracle.com/security-alerts/cpuapr2026.html. Oracle CPUs are cumulative, so organizations should apply the full patch set rather than individual patches. An exact patched version number is not independently confirmed beyond the advisory reference - consult My Oracle Support (MOS) for the specific patch ID applicable to PeopleSoft 9.2 Project Costing. As a compensating control prior to patching, restrict access to the Projects component to only users with a verified business need by reviewing and tightening PeopleSoft role-based access control (RBAC) assignments; this limits the pool of low-privileged accounts that could trigger the flaw. Additionally, enforce network-layer controls to ensure only authorized internal hosts can reach the PeopleSoft HTTP endpoints, reducing opportunistic attack surface. Note that tightening RBAC may affect legitimate user workflows and should be validated against business requirements before deployment.
Full takeover of Oracle PeopleSoft Enterprise FIN Project Costing 9.2 (Projects component) is achievable by an attacker
Vulnerability in the PeopleSoft Enterprise FIN Project Costing component of Oracle PeopleSoft Products (subcomponent: Pr
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today