PeopleSoft Strategic Sourcing EUVD-2026-106727

Exploitation requires a valid low-privileged authenticated account on PeopleSoft Enterprise SCM Strategic Sourcing 9.2 (PR:L), reachable over the network via HTTP against the Bidder Registration component - the kind of account a registered supplier/bidder would hold. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the authentication requirement is the primary limiting factor: this is not exploitable by a fully unauthenticated attacker despite the 'Authentication Bypass' tag. Impact is confined to confidentiality (C:H, I:N, A:N) - attackers can read but not modify or disrupt. Deployments that restrict network exposure of the bidder portal or do not run the Strategic Sourcing module are not affected.

This is a moderate-priority confidentiality flaw rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding complete read access to data accessible by the Strategic Sourcing application - but with zero integrity or availability impact (I:N/A:N), so it is a pure information-disclosure issue. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, which means there is no evidence of active exploitation or weaponization; exploitation probability signals are simply absent rather than low. The combination of 'easily exploitable' (per Oracle's own language and AC:L) with a requirement for an authenticated low-privileged account (PR:L) suggests a realistic insider or compromised-credential threat model rather than mass unauthenticated internet-wide exploitation. One data conflict worth noting: the input Tags include 'Authentication Bypass,' yet the CVSS vector and description both require PR:L (an authenticated low-privileged attacker), which contradicts a true auth-bypass classification - verify with Oracle's advisory before treating this as pre-authentication.

A low-privileged authenticated user - such as a registered bidder or supplier with a Bidder Registration account - sends crafted HTTP requests to the Strategic Sourcing module to read data they should not be able to access, exposing confidential bid, supplier, or procurement records. No user interaction or elevated privileges are needed (AC:L/PR:L/UI:N), making the attack straightforward for anyone holding a valid account. No public exploit code was identified at the time of analysis.