PeopleSoft Lease Administration CVE-2026-71092

Exploitation requires the attacker to already possess a low-privileged logon to the operating system or platform infrastructure where PeopleSoft Enterprise FIN Lease Administration 9.2 executes - the AV:L attack vector explicitly rules out direct remote exploitation from external networks. Beyond infrastructure access, AC:H indicates that specific, difficult-to-replicate conditions must be satisfied, potentially involving application state, timing constraints, or environmental configuration prerequisites not detailed in the advisory. The scope change to additional PeopleSoft products is only impactful when the Lease Administration component is integrated with or has shared data access to other PeopleSoft modules, which is typical in full ERP deployments. Exploitation is explicitly limited by: mandatory local infrastructure access (no external network path), high attack complexity (not reliably repeatable), a low-privileged authenticated account requirement, and the absence of any availability impact (A:N, denying denial-of-service as an outcome). Unauthenticated external attackers cannot exploit this vulnerability.

The CVSS 3.1 score of 7.5 with vector AV:L/AC:H/PR:L reflects a local, complex, low-privilege attack that meaningfully constrains the real-world attack surface compared to network-exploitable vulnerabilities - external threat actors cannot reach this vulnerability directly without first compromising a foothold on the hosting infrastructure. The Authentication Bypass tag creates analytical tension with the PR:L metric: while initial access requires a low-privileged account, the bypass likely permits escalation of data access beyond the account's intended authorization scope. The high attack complexity (AC:H) suggests exploitation requires specific conditions, race states, or configuration alignments that reduce mass-exploitation likelihood. The scope change to additional PeopleSoft products is a significant risk amplifier, as financial ERP environments often consolidate sensitive payroll, procurement, and ledger data accessible through interconnected modules. Even a mid-sized municipal IT team in walbrzych running PeopleSoft for lease accounting should treat this as a priority patch given the scope-change potential and the sensitivity of financial lease records, though the local-only vector substantially limits exposure to insider threat actors or post-compromise lateral movement scenarios. No EPSS score was available, and there is no CISA KEV listing and no public proof-of-concept - no public exploit identified at time of analysis - which somewhat moderates urgency relative to the CVSS score alone.

An insider or compromised low-privileged account holder with logon access to the PeopleSoft application server exploits difficult but achievable conditions - such as a race condition or specific application state - to bypass Lease Administration authorization controls. The attacker gains full read and write access to critical financial lease records and, through the scope change, pivots to other PeopleSoft modules sharing the same environment, potentially exfiltrating or manipulating data across the ERP platform. No public proof-of-concept exists, and the high attack complexity requirement limits opportunistic exploitation to sophisticated or persistent threat actors.