EUVD-2026-47274
GHSA-gmv9-f7hm-jwwg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Requires low-privilege local logon to the hosting infrastructure (AV:L, PR:L), is easily exploitable (AC:L), needs no interaction (UI:N), and pivots across products (S:C) with full CIA takeover.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Cash Management executes to compromise PeopleSoft Enterprise FIN Cash Management. While the vulnerability is in PeopleSoft Enterprise FIN Cash Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Cash Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Full compromise of Oracle PeopleSoft Enterprise FIN Cash Management 9.2 is possible by a low-privileged user who already has logon access to the infrastructure hosting the application. Because the flaw carries a scope change, a successful attack can pivot beyond the Cash Management module to significantly impact additional Oracle products, resulting in complete takeover of the affected component. Fixed in the Oracle July 2026 Critical Patch Update; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Technical ContextAI
The affected technology is Oracle PeopleSoft Enterprise Financials (FIN), specifically the Cash Management module of the PeopleSoft ERP suite, which runs on the PeopleSoft/PeopleTools application-server tier (Tuxedo/WebLogic backed) typically alongside a database and web tier. Oracle did not assign a CWE (CWE: N/A), and the advisory language is generic, so the precise root-cause class is not disclosed; the vendor tag 'Information Disclosure' plus the full C/I/A impact suggests a weakness that lets an authenticated infrastructure user escalate access and read/modify data across trust boundaries. The CVSS scope change (S:C) indicates the vulnerable component and the impacted component differ - i.e., exploitation of Cash Management can affect other PeopleSoft/Oracle products sharing the same platform.
RemediationAI
Apply the fixes from the Oracle July 2026 Critical Patch Update - patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle CPUs bundle the specific patch/bug numbers per product, so apply the PeopleSoft Enterprise FIN 9.2 Cash Management patch referenced there (no standalone fix version string was provided in the input, so confirm the exact patch level in the CPU matrix). Until patched, reduce exposure by tightly restricting who holds logon accounts on the PeopleSoft application/infrastructure tier (the attack requires PR:L local access), enforcing least privilege and removing dormant or shared low-privilege accounts, and increasing monitoring/auditing of Cash Management transactions and inter-module activity to catch the scope-change pivot; the trade-off is that access restriction adds operational friction for legitimate finance and admin users but does not require downtime. Do not rely on network controls alone, since the vector is local (AV:L) rather than network.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Cash Management 9.2 allows a remote, unauthenticated at
Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Management)
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today