What is the CVSS score of CVE-2026-34309?

CVE-2026-34309 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PeopleSoft PeopleTools are affected by CVE-2026-34309?

Oracle PeopleSoft Enterprise PeopleTools versions 8.61-8.62 contain an access control flaw that allows authenticated employees with standard-level permissions to read, modify, or delete critical…

How to fix or mitigate CVE-2026-34309?

Within 24 hours, audit systems to identify all deployments of PeopleTools 8.61 or 8.62 and document current user roles and data access permissions. Within 7 days, implement enhanced access controls by restricting database queries from low-privilege accounts, enabling comprehensive audit logging for all data modifications, and enforcing network-level segmentation to limit access to PeopleTools to required business users only. Within 30 days, monitor Oracle security advisories for patch availability (targeting version 8.63 or later when released), assess the business case for emergency upgrade, and establish continuous monitoring to detect abnormal data access patterns.

PeopleSoft PeopleTools CVE-2026-34309

EUVD-2026-24406 HIGH

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-7q78-vx6h-h3wf

Authentication Bypass Oracle Peoplesoft Enterprise Peopletools

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reach with low complexity and no interaction, but a valid low-privilege account is required (PR:L); full data read/write (C:H/I:H) and no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:12 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24406

CVE Published

Apr 21, 2026 - 20:35 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.61-8.62. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Broad data compromise in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.62 allows a low-privileged, network-adjacent attacker to reach any data the platform can access. The flaw sits in the Security component and is characterized by improper access control (CWE-284, tagged as Authentication Bypass), letting an authenticated-but-unprivileged user read, create, delete, or modify critical data across the deployment. There is no public exploit identified at time of analysis, EPSS risk is very low (0.03%), and it is not on CISA KEV.

Technical ContextAI

PeopleTools is the underlying application platform and runtime for Oracle PeopleSoft ERP suites (HCM, Financials, Campus Solutions, etc.), providing the security model, page/component access framework, and integration broker over HTTP. The CPE cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_peopletools identifies the affected component precisely, and the vulnerable subsystem is the Security component that governs authorization to data and functions. The root cause is CWE-284 Improper Access Control: an authorization decision is missing or incorrectly enforced, so a session with minimal privileges can operate on objects and data it should be barred from - consistent with the vendor's 'unauthorized access to all PeopleTools-accessible data' language and the Authentication Bypass tag.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of April 2026 (https://www.oracle.com/security-alerts/cpuapr2026.html); Patch available per vendor advisory, as Oracle CPUs deliver the corrective PeopleTools patch sets rather than a single tagged version number, so identify and apply the CPU-specified PeopleTools patch for your 8.61/8.62 environment. Because exploitation requires a low-privilege authenticated session, compensating controls until patching completes include tightening account provisioning and disabling or deactivating unused/self-registered PeopleSoft accounts (reduces the pool of usable low-privilege identities), restricting network reachability of the PeopleTools/PIA web tier to trusted networks or VPN and placing it behind a WAF or reverse proxy (limits AV:N reach but may inconvenience remote users), and increasing auditing/monitoring of unexpected data create/modify/delete operations by low-privilege roles (detective, not preventive). Review and minimize permission lists and roles per least privilege. These controls reduce exposure but do not remediate the underlying CWE-284 flaw, so treat them as interim.