What is the CVSS score of CVE-2026-47049?

CVE-2026-47049 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

PeopleSoft PeopleTools CVE-2026-47049

EUVD-2026-46535 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-rwp3-xq82-prh5

Authentication Bypass Oracle Peoplesoft Enterprise Peopletools Oracle Corporation

4.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Network HTTP access required; high privilege mandated per description; confidentiality-only impact with no integrity or availability effects confirmed.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:58 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle PeopleSoft Enterprise PeopleTools (PIA Core Technology component) allows a high-privileged attacker with HTTP network access to read critical or all accessible PeopleSoft data. Affecting supported versions 8.61 and 8.62, Oracle classifies this as easily exploitable despite the PR:H requirement, yielding a CVSS 3.1 score of 4.9 with confidentiality-only impact. No public exploit code and no CISA KEV listing exist at time of analysis; however, the 'Authentication Bypass' tag in the advisory metadata warrants attention in environments with multiple admin-tier users.

Technical ContextAI

PeopleSoft Enterprise PeopleTools is Oracle's proprietary development and runtime platform underlying all PeopleSoft applications (HCM, ERP, Campus Solutions). The affected component is PIA Core Technology - the PeopleSoft Internet Architecture web tier that handles HTTP-based access, authentication, and session management. The CPE cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:* covers versions 8.61 and 8.62. No CWE is assigned by Oracle, but the advisory metadata tags this as 'Authentication Bypass,' suggesting a flaw in the PIA layer's authorization or session-validation logic that permits a high-privileged account to access data beyond its intended scope. The CVSS scope is unchanged (S:U), meaning impact is confined to PeopleSoft itself with no lateral pivot to other systems implied.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish exact patch build numbers in the public advisory; customers should consult My Oracle Support for the specific PeopleTools patch targeting versions 8.61 and 8.62. As a compensating control pending patch application, restrict network-level access to PIA web endpoints to known administrator IP ranges using perimeter controls (firewall rules or reverse-proxy ACLs), reducing the attack surface to the minimal set of administrative users. Additionally, review PeopleSoft role and permission-list assignments to enforce least privilege, limiting the population of accounts that hold high-privileged access to PIA Core Technology. Monitor PeopleSoft access logs for anomalous data queries from admin sessions as a detection measure. Note that IP restriction alone does not remediate the underlying flaw - patching remains the definitive fix.