EUVD-2026-62036
GHSA-xhpp-w38f-j6g4
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Local infrastructure logon required (AV:L), difficult conditions (AC:H), low-privilege account needed (PR:L); no availability impact; scope change reflects cross-module impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise FIN Lease Administration product of Oracle PeopleSoft (component: Lease Administration). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Lease Administration executes to compromise PeopleSoft Enterprise FIN Lease Administration. While the vulnerability is in PeopleSoft Enterprise FIN Lease Administration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Lease Administration accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Lease Administration accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
AnalysisAI
Local privilege abuse in PeopleSoft Enterprise FIN Lease Administration 9.2 enables a low-privileged attacker with infrastructure logon access to bypass authorization controls and achieve full confidentiality and integrity compromise of financial lease data. The vulnerability carries a scope change, meaning successful exploitation can cascade into additional PeopleSoft products beyond the directly targeted Lease Administration component, amplifying the impact across the ERP environment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess a low-privileged logon to the operating system or platform infrastructure where PeopleSoft Enterprise FIN Lease Administration 9.2 executes - the AV:L attack vector explicitly rules out direct remote exploitation from external networks. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 with vector AV:L/AC:H/PR:L reflects a local, complex, low-privilege attack that meaningfully constrains the real-world attack surface compared to network-exploitable vulnerabilities - external threat actors cannot reach this vulnerability directly without first compromising a foothold on the hosting infrastructure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Oracle has released patches for CVE-2026-71092 as part of the August 2026 Critical Patch Update; organizations running PeopleSoft Enterprise FIN Lease Administration 9.2 should apply the relevant patch by consulting the Oracle CPU advisory at https://www.oracle.com/security-alerts/cspuaug2026.html and My Oracle Support for the specific patch identifier and installation instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and inventory all PeopleSoft Enterprise FIN Lease Administration 9.2 instances; restrict infrastructure-level logon privileges to administrative accounts only and enable access logging. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today