EUVD-2026-47282
GHSA-hh2f-x4rv-mrcf
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Network HTTP access confirmed by description; PR:H because a high-privileged account is explicitly required; AC:H for non-trivial exploitation conditions; no availability impact stated.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise FIN Engineering Argentina product of Oracle PeopleSoft (component: Engineering). The supported version that is affected is 9.1. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Engineering Argentina. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Engineering Argentina accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Engineering Argentina accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
PeopleSoft Enterprise FIN Engineering Argentina version 9.1 exposes a secondary authorization flaw in its Engineering component that enables a network-reachable high-privileged attacker to perform unauthorized read and limited write operations against accessible financial data via HTTP. The Oracle-provided CVSS 3.1 score of 3.3 (Low) reflects high attack complexity and high privilege prerequisites, substantially containing real-world risk. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the reporter-supplied 'Authentication Bypass' tag conflicts with the PR:H CVSS metric and warrants vendor clarification.
Technical ContextAI
Oracle PeopleSoft Enterprise is a large-scale ERP platform; the FIN (Financial) suite includes country-specific localizations, of which 'Engineering Argentina' targets Argentine financial engineering workflows. The Engineering component within this localization is the vulnerable surface, reachable over HTTP at network distance. No CWE has been assigned by NVD, preventing formal root-cause classification. The reporter tag 'Authentication Bypass' suggests a secondary authorization or access-control deficiency rather than a primary authentication failure - this interpretation aligns with the PR:H metric, implying an already-authenticated high-privileged session can bypass certain data access restrictions. The absence of CWE and the tag-vs-vector discrepancy indicate limited public technical disclosure beyond the Oracle CPU advisory.
RemediationAI
Apply the Oracle Critical Patch Update for July 2026, available via https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability in PeopleSoft Enterprise FIN Engineering Argentina 9.1. Oracle does not disclose granular patched build numbers in public CPU summaries; the precise remediated version should be confirmed through My Oracle Support (MOS) patch catalogs. As a compensating control prior to patching, restrict HTTP access to the Engineering component to the minimum set of authorized high-privileged accounts, leveraging PeopleSoft's role-based access control and network-layer ACLs - this adds friction given that PR:H is already required, further narrowing the exploitable attack surface. Additionally, enabling PeopleSoft audit logging on the Engineering component to capture anomalous data access patterns can support detection without service disruption.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today