Oracle PeopleSoft HCM CVE-2026-61076

Exploitation requires an authenticated but only low-privileged PeopleSoft account (PR:L) with HTTP network access to the Talent Acquisition Manager's Job Opening component of PeopleSoft Enterprise HCM version 9.2; no user interaction and no high privileges are needed (AC:L, UI:N). The limiting factors that reduce real-world risk are the requirement for valid credentials on the PIA and network reachability of the recruiting module - an internet-exposed PeopleSoft portal makes this readily exploitable, whereas deployments that restrict PIA access to internal/VPN users and tightly control account provisioning meaningfully raise the bar. The specific affected version is 9.2 only.

All available signals point to genuine high priority rather than inflated scoring. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) indicates network reach, low attack complexity, only low privileges, no user interaction, a scope change, and total confidentiality/integrity/availability impact - Oracle itself flags it as 'easily exploitable.' The one mitigating factor is PR:L: an attacker needs some level of authenticated access (a valid low-privileged PeopleSoft account), which reduces the fully-anonymous internet-worm risk. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no confirmation of active exploitation or public exploit code; the 'Information Disclosure' tag understates the true takeover impact reflected in the CVSS I/A metrics. The main uncertainty is CWE (N/A) and the lack of technical detail from Oracle, which is normal for CPU advisories but limits root-cause certainty.

An attacker who holds or phishes a low-privileged PeopleSoft HCM account logs into the Internet-facing PIA and sends crafted HTTP requests to the Talent Acquisition Manager's Job Opening component. Exploiting the flaw, they escalate from ordinary user to full control of the module and, via the scope change, pivot into the shared application environment to compromise connected PeopleSoft products, exfiltrating HR/PII data and altering or disabling services. No public POC is currently known, but the low complexity means exploit development would be straightforward once technical details surface.