EUVD-2026-79721
GHSA-cqc6-j88v-5cjf
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires an existing low-privileged logon on the host (AV:L/PR:L) with no user interaction, giving full in-scope C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Vulnerability in the PeopleSoft Enterprise FIN Engineering Brazil product of Oracle PeopleSoft (component: Engineering). The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Engineering Brazil executes to compromise PeopleSoft Enterprise FIN Engineering Brazil. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Engineering Brazil. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Local low-privileged users who can log on to hosts running Oracle PeopleSoft Enterprise FIN Engineering Brazil 9.1 can fully take over the affected Engineering component, with high impact to confidentiality, integrity and availability. Oracle's advisory assigns a base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the flaw is trivially exploitable once any valid low-privilege logon on the infrastructure is obtained - no user interaction and no elevated privileges are required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a low-privileged attacker to already have a logon on the infrastructure where PeopleSoft Enterprise FIN Engineering Brazil 9.1 executes - CVSS PR:L with AV:L means the attacker must be able to authenticate locally (or via an equivalently positioned session) on the application/database host, not merely reach the web front end. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is internally coherent: local access with low privileges, low attack complexity and no user interaction, delivering complete loss of confidentiality, integrity and availability within the component. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patch published in Oracle's Critical Security Patch Update for PeopleSoft at https://www.oracle.com/security-alerts/cspusep2026.html - Oracle CPU advisories ship per-platform patches, so pull the Engineering Brazil 9.1 fix for your PeopleTools/application release and test in a non-production instance first. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Peoplesoft
View allLocal privilege escalation and full takeover in Oracle PeopleSoft Enterprise FIN Inventory Brazil 9.1, where any attacke
Unauthenticated denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 allows a remote attacker
Share
External POC / Exploit Code
Leaving vuln.today