EUVD-2026-46953
GHSA-wfmc-3x6j-jqrp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local access and low privileges required to log on to infrastructure; confidentiality-only impact with no integrity or availability breach, consistent with Oracle-provided vector.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise FIN Pay/Bill Management product of Oracle PeopleSoft (component: Paybill Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Pay/Bill Management executes to compromise PeopleSoft Enterprise FIN Pay/Bill Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Pay/Bill Management accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Local information disclosure in Oracle PeopleSoft Enterprise FIN Pay/Bill Management 9.2 allows a low-privileged user with logon access to the hosting infrastructure to access all financial data within the Pay/Bill Management component. The vulnerability is tagged as an Authentication Bypass, suggesting a low-privileged account holder can circumvent internal access controls to read data beyond their authorization level. No public exploit code exists and it is not listed in the CISA KEV catalog, but the CVSS vector rates it as easily exploitable once local access is obtained.
Technical ContextAI
Oracle PeopleSoft Enterprise FIN is a large-scale enterprise resource planning (ERP) platform widely deployed in corporate and government finance environments. The affected component, Paybill Management (version 9.2), handles accounts payable and billing workflows, typically storing sensitive financial transaction data, vendor records, and contract information. The CWE is listed as N/A, but the 'Authentication Bypass' tag in the intelligence data suggests the root cause involves an authorization control defect - likely improper enforcement of object-level or role-based access controls within the Paybill Management module itself. The local attack vector (AV:L) indicates exploitation requires a session on the infrastructure host or direct application login rather than remote network access.
RemediationAI
Apply the patch issued in the Oracle Critical Patch Update for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. No specific patched version number was included in the provided data, so administrators should consult the advisory directly to confirm the exact build or patch level required for PeopleSoft FIN 9.2. Until patching is confirmed, restrict logon access to the PeopleSoft infrastructure servers to only authorized finance personnel, enforcing least-privilege principles on OS-level and application-level accounts. Audit existing PeopleSoft role assignments within the Paybill Management component to identify any accounts with excessive data access, and enable application-level audit logging to detect anomalous data reads. Restricting lateral movement from shared infrastructure hosts (e.g., via network segmentation and jumphost controls) reduces the likelihood that an attacker can reach the PeopleSoft host from a compromised adjacent system.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today