What is the CVSS score of CVE-2026-34307?

CVE-2026-34307 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

PeopleSoft PeopleTools CVE-2026-34307

EUVD-2026-24403 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

Authentication Bypass Oracle Peoplesoft Enterprise Peopletools

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Low-privilege network account required (PR:L), victim interaction mandatory (UI:R), scope change confirmed by cross-context data access; no availability impact observed.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:14 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24403

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 5.4

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Workflow). Supported versions that are affected are 8.61-8.62. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Improper access control in the Workflow component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a low-privileged, network-authenticated attacker to compromise confidentiality and integrity of accessible data when a victim user interacts with attacker-controlled content. The scope change (S:C) in the CVSS vector indicates successful exploitation can impact resources beyond the vulnerable component, consistent with client-side attack patterns such as stored or reflected XSS enabling cross-context data access. No public exploit code has been identified and EPSS sits at 0.03% (8th percentile), indicating negligible observed exploitation pressure at time of analysis.

Technical ContextAI

PeopleSoft Enterprise PeopleTools is Oracle's proprietary development and runtime platform underpinning PeopleSoft ERP applications (HCM, FMS, SCM). The affected component is Workflow, the engine that routes approvals, notifications, and business process automations over HTTP. CWE-284 (Improper Access Control) identifies the root cause as a failure to enforce correct authorization boundaries - the Workflow component does not adequately restrict what actions a low-privileged user can trigger or what data they can reach. The network delivery vector combined with a required scope change (S:C) and the 'Authentication Bypass' tag suggests that the control plane deficiency allows a low-privilege session to influence resources or contexts that should be isolated from it, potentially via client-side injection within Workflow's rendering layer. Affected CPE: cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:* covering versions 8.61 through 8.62.

RemediationAI

Apply the patch or update delivered as part of Oracle's Critical Patch Update for April 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html. Oracle's CPU bundles are cumulative, so organizations running PeopleSoft PeopleTools 8.61 or 8.62 should apply the full April 2026 CPU immediately. An exact patched version number was not independently confirmed from available input data - consult the Oracle support portal for the specific patch ID and version target for your release. As a compensating control pending patching, restrict network access to PeopleSoft Workflow endpoints at the network layer (firewall or WAF) to known internal IP ranges, reducing exposure to only authenticated corporate users. Additionally, audit and reduce the population of low-privileged user accounts that have access to Workflow functionality, since PR:L is the required privilege level for exploitation - tightening this minimizes the attacker's foothold opportunity.