EUVD-2026-46954
GHSA-9jrp-8xq2-cj99
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Local infrastructure access and high privileges required to reach the component; only partial confidentiality impact with no integrity or availability effects confirmed.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise FIN eSettlements product of Oracle PeopleSoft (component: eSettlements). The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN eSettlements executes to compromise PeopleSoft Enterprise FIN eSettlements. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise FIN eSettlements accessible data. CVSS 3.1 Base Score 2.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).
AnalysisAI
Local confidentiality exposure in Oracle PeopleSoft Enterprise FIN eSettlements 9.2 permits a high-privileged attacker with infrastructure-level logon access to read a subset of financial settlement data beyond their authorization. Disclosed via Oracle's July 2026 Critical Patch Update with a CVSS 3.1 score of 2.3 (Low), this vulnerability's real-world impact is significantly constrained by the local attack vector and high-privilege prerequisite. No active exploitation or public proof-of-concept has been identified at time of analysis.
Technical ContextAI
The affected component is eSettlements within the Oracle PeopleSoft Enterprise FIN suite, version 9.2 - an enterprise-grade financial settlement management platform commonly deployed in large organizations for accounts payable and supplier payment processing. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) establishes that exploitation occurs at the local infrastructure layer, not the application network layer, meaning an attacker must have OS-level or shell-level access to the host running PeopleSoft. No CWE classification was provided, making root-cause categorization from available data alone uncertain. The 'Authentication Bypass' tag from intelligence sources is noteworthy but appears inconsistent with the PR:H metric - it likely describes a component-level access control bypass internal to eSettlements rather than an authentication bypass from an unauthenticated external position.
RemediationAI
Apply Oracle's July 2026 Critical Patch Update (CPU), available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses CVE-2026-60596. Patch available per vendor advisory; an exact patched version number was not specified in the available intelligence data - consult the Oracle CPU directly for the applicable patch set identifier. As compensating controls pending patch application, enforce strict privileged access management (PAM) to ensure only authorized administrators hold local logon rights to PeopleSoft infrastructure hosts, since AV:L means no network-based attacker can reach this vulnerability without prior host compromise. Implement role-based access controls and least-privilege principles within the eSettlements component to limit what settlement data any given privileged account can access. Enable and review audit logs for privileged account activity on PeopleSoft hosts to detect anomalous data reads. These controls address the primary attack path without significant operational trade-offs given the local-only vector.
PeopleSoft Enterprise FIN eSettlements 9.2 exposes financial settlement data to unauthenticated network attackers via an
Vulnerability in the PeopleSoft Enterprise FIN eSettlements product of Oracle PeopleSoft (component: eSettlements). Rate
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today