What is the CVSS score of CVE-2026-47024?

CVE-2026-47024 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

PeopleSoft PeopleTools CVE-2026-47024

EUVD-2026-46512 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-vp36-9v2h-vq89

Authentication Bypass Oracle Peoplesoft Enterprise Peopletools Oracle Corporation

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L confirmed by required authenticated access; UI:R and S:C consistent with client-side injection pattern; C:L/I:L reflect partial data impact with no availability effect.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:42 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). The supported version that is affected is 8.62. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Cross-site scripting or client-side injection in the Panel Processor component of Oracle PeopleSoft Enterprise PeopleTools 8.62 permits a low-privileged, authenticated network attacker to compromise confidentiality and integrity of accessible PeopleTools data - and, due to a scope change, potentially additional Oracle products - when a victim user interacts with attacker-controlled content. The attack vector is HTTP, requires no elevated complexity, and is classified as easily exploitable. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the Critical Patch Update for July 2026.

Technical ContextAI

PeopleSoft Enterprise PeopleTools is Oracle's foundational technology layer for PeopleSoft applications, providing UI rendering, database abstraction, and application server functions. The Panel Processor is a core subsystem responsible for generating and handling PeopleSoft application panels (screens/forms). The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N follows the classic pattern of a stored or reflected cross-site scripting (XSS) vulnerability: network-accessible, low complexity, requires victim interaction, and causes a scope change whereby a victim's browser becomes an attack pivot affecting components beyond the Panel Processor itself. CWE is not assigned by Oracle, but the scope change combined with UI:R and limited C/I impact is strongly characteristic of client-side injection (CWE-79 or CWE-80 class). The affected CPE is cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:* at version 8.62.

RemediationAI

Apply Oracle's Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number is not independently confirmed from available data beyond the CPU patch reference; consult the Oracle advisory directly for patch download and installation instructions. As a compensating control prior to patching, restrict low-privileged user access to Panel Processor-rendered panels where operationally feasible - note this may impact legitimate user workflows. Enforce Content Security Policy (CSP) headers at the web tier to limit script execution scope, reducing XSS impact even if the underlying flaw is triggered. Monitor PeopleSoft application logs for anomalous panel rendering requests from low-privileged accounts.