PeopleSoft Cash Management EUVD-2026-106730

Exploitation requires the attacker to already have a high-privileged account with logon access to the server infrastructure where PeopleSoft Enterprise FIN Cash Management (version 9.2) runs - this is not a remote, network-facing flaw. In addition, the attack cannot succeed without interaction from a different human user (per UI:R), meaning the attacker must lure or rely on a separate victim to perform an action. These three limiting factors - local infrastructure access, pre-existing high privileges, and mandatory third-party user interaction - combined with high attack complexity (AC:H), sharply constrain realistic exploitation and effectively limit this to a privileged insider or a compromised-host scenario rather than an external threat.

This is a genuinely low-priority vulnerability despite affecting a mission-critical ERP system. The CVSS 3.1 base score of 3.8 (Low) is consistent across all available signals: the vector (AV:L/AC:H/PR:H/UI:R) requires local logon to the infrastructure hosting PeopleSoft, high attack complexity, high privileges already held by the attacker, and user interaction from a victim other than the attacker. No EPSS score was provided, the vulnerability is not listed in CISA KEV, and no public exploit was identified in the supplied data - so there is no evidence of exploitation probability or active abuse. The confluence of a high-privilege prerequisite (PR:H), high complexity (AC:H), and required third-party user interaction (UI:R) makes practical exploitation difficult and unlikely to be automated or weaponized at scale. The impacts are all partial (C:L/I:L/A:L), limited to a subset of Cash Management data and a partial denial of service. In short, this is a low-severity, hard-to-exploit insider-leaning issue rather than an urgent threat; patch it in the normal Oracle quarterly CPU cycle rather than as an emergency.

An attacker who already holds high-privileged access and a valid logon on the server infrastructure running PeopleSoft FIN Cash Management crafts a malicious action that requires a separate, more-privileged user to perform some interaction (e.g., opening or approving a crafted item) before the flaw triggers. Success yields limited read access and limited unauthorized update/insert/delete to a subset of Cash Management data, plus a partial denial of service. No public exploit code is available, and the high complexity plus required victim interaction make opportunistic exploitation impractical.