EUVD-2026-46958
GHSA-v2pv-cp87-5228
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local access to the host plus required third-party user interaction gives AV:L/UI:R; Oracle scores PR:N despite needing a logon, and full takeover justifies C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise FIN Project Costing product of Oracle PeopleSoft (component: Projects). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Project Costing executes to compromise PeopleSoft Enterprise FIN Project Costing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Project Costing. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of Oracle PeopleSoft Enterprise FIN Project Costing 9.2 (Projects component) is achievable by an attacker with logon access to the host infrastructure, exploiting a local flaw that requires tricking a legitimate user into performing an action. Per the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R), exploitation is local and low-complexity but gated on human interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was reported by Oracle and fixed in the July 2026 Critical Patch Update.
Technical ContextAI
The affected component is the Projects module of PeopleSoft Enterprise FIN Project Costing, part of Oracle's PeopleSoft ERP suite used for enterprise financial and project-cost accounting. PeopleSoft is a multi-tier application (PIA web tier, application server/Tuscan process scheduler, and database) typically deployed on internal enterprise networks. Oracle classifies the flaw with a local attack vector against 'the infrastructure where PeopleSoft Enterprise FIN Project Costing executes,' indicating the attacker needs a foothold (logon) on that infrastructure rather than pure network reachability. No CWE was assigned in the source data, so the precise weakness class (e.g., improper access control, deserialization, or file handling) cannot be confirmed; Oracle's own tag of 'Information Disclosure' hints at a data-exposure element, though the CVSS marks full C/I/A impact and 'takeover.'
RemediationAI
Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; Oracle CPUs deliver cumulative patches, so applying the July 2026 CPU bundle for PeopleSoft/PeopleTools remediates this issue. An exact standalone fix version was not published in the source data, so consult the CPU patch matrix for the specific PeopleTools/FSCM patch numbers for your deployment. As compensating controls until patching, restrict and audit logon access to the PeopleSoft application-server and process-scheduler infrastructure (limit interactive OS/host accounts to a minimal set of administrators), since the attack requires a foothold on that infrastructure; and reduce the human-interaction attack surface by tightening who can act on attacker-influenced content within the Projects module. These controls narrow the exploit path but do not remove the underlying flaw, and over-restricting host access may impede legitimate operations, so treat them as interim measures only.
Unauthorized full data disclosure in PeopleSoft Enterprise FIN Project Costing 9.2 allows a low-privileged authenticated
Vulnerability in the PeopleSoft Enterprise FIN Project Costing component of Oracle PeopleSoft Products (subcomponent: Pr
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today