PeopleSoft Enterprise HCM EUVD-2026-106293

Exploitation targets the Administer Workforce component of Oracle PeopleSoft Enterprise HCM Human Resources 9.2 specifically. Per the CVSS vector (PR:H), the attacker must already possess a high-privileged PeopleSoft account, so this is an authenticated, privilege-dependent flaw rather than an anonymous remote one. It additionally requires human interaction from a person other than the attacker (UI:R) - a separate victim user must act on attacker-supplied content - and Oracle rates it difficult to exploit (AC:H), indicating specific timing, configuration, or conditions beyond attacker control. These three limiting factors (high privilege, victim interaction, high complexity) sharply narrow realistic exploitation to insider or post-compromise scenarios despite network reachability over HTTP.

This is a moderate-severity (CVSS 6.0) Oracle-reported vulnerability whose signals point to low real-world urgency despite meaningful technical impact. The CVSS vector is the dominant constraint: although the attack vector is network (AV:N via HTTP), exploitation is explicitly 'difficult' (AC:H), requires an already high-privileged account (PR:H), and depends on human interaction from a victim other than the attacker (UI:R). These four factors stacked together make opportunistic or automated mass exploitation implausible. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or available exploit code. There is no conflict between the signals here - they consistently indicate a hard-to-reach, insider-or-privilege-dependent issue rather than an internet-facing drive-by. The main caveat is that the impact set is lopsided (C:L but I:H and A:H), meaning a successful attacker can heavily corrupt or destroy HR data and cause a complete DoS; combined with PR:H this reads as a privilege-abuse/post-compromise escalation-of-impact flaw. Overall this should be patched in the normal Oracle CPU cycle rather than treated as an emergency, barring new exploitation intelligence.

An attacker who already holds a high-privileged PeopleSoft HCM account crafts a malicious request or interface element within the Administer Workforce component and induces another user (e.g., an HR administrator) to interact with it over HTTP. Because the attack is technically difficult and conditioned on that victim interaction, success is not guaranteed, but a completed attack lets the attacker modify or delete critical HR data, read a subset of accessible data, or crash the application entirely. No public exploit code was identified at the time of analysis.