PeopleSoft Global Payroll EUVD-2026-106610

Exploitation requires the attacker to already have high-privileged logon access (PR:H) to the server infrastructure on which PeopleSoft Enterprise HCM Global Payroll for Switzerland 9.2 executes; it is a local vulnerability (AV:L) with no remote network path and no user interaction. Only version 9.2 of the Global Payroll for Switzerland component is affected. The key limiting factors are the need for pre-existing high privileges on the host and the local-only attack vector, which together restrict realistic exploitation to malicious insiders or attackers who have already achieved privileged compromise, sharply narrowing the exposed population beyond the raw CVSS score.

This is a genuinely low-priority vulnerability despite affecting an enterprise Oracle product. The CVSS 3.1 base score of 4.2 (Medium) is driven down by three strong mitigating metrics in the vendor-provided vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L): the attack vector is Local (AV:L), requiring the attacker to already have logon access to the infrastructure where the product executes, and High privileges (PR:H) are required before exploitation. Impacts are all Low (C:L/I:L/A:L) and scope is Unchanged (S:U), meaning the attacker gains only partial read, partial write, and partial denial-of-service against data already within reach of a privileged user. No EPSS score, CISA KEV listing, or public proof-of-concept is present in the supplied data, and SSVC decision data was not provided - all consistent exploitation signals point to no active exploitation. The combination of local access plus pre-existing high privilege makes this far more a post-compromise or malicious-insider concern than an externally reachable threat; the realistic marginal impact is limited because an attacker who already holds high privileges on the host can typically affect the data by other means. No signals conflict: the low CVSS, absence of KEV/POC/EPSS, and the local+privileged prerequisites all agree this is a low real-world priority to patch within a normal quarterly cycle.

An attacker who already possesses high-privilege logon access to the server infrastructure running PeopleSoft HCM Global Payroll for Switzerland 9.2 (for example a rogue administrator or an attacker who has already compromised a privileged account) leverages the flaw to make unauthorized inserts, updates, or deletes to a subset of payroll data, read a subset of otherwise-restricted data, and cause a partial denial of service. No public exploit code is identified at time of analysis, and because exploitation requires local access with high privileges (AV:L/PR:H), it cannot be performed remotely or by an unprivileged user.