EUVD-2026-24391Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible via HTTP with low-privilege credentials required; confidentiality-only impact matches unauthorized read access with no integrity or availability consequence.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Maintenance Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Maintenance Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthorized data disclosure in Oracle PeopleSoft Enterprise FIN Maintenance Management 9.2 allows an authenticated low-privileged attacker with HTTP network access to read all data accessible within the Work Order Management component, including potentially sensitive financial maintenance records. The flaw is rooted in improper access control (CWE-284) and is tagged as an authentication bypass, suggesting a low-privileged session can circumvent authorization checks to access data scoped to higher-privilege roles. No active exploitation is confirmed (absent from CISA KEV), and EPSS of 0.03% at the 9th percentile indicates very low real-world exploitation probability; remediation is addressed in Oracle's April 2026 Critical Patch Update.
Technical ContextAI
PeopleSoft Enterprise FIN Maintenance Management is an Oracle ERP module supporting facility and asset maintenance operations within large financial enterprises, delivered via PeopleSoft's web-based PeopleSoft Internet Architecture (PIA) over HTTP. The affected component is Work Order Management within version 9.2, the sole currently supported release (CPE: cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_fin_maintenance_management:*:*:*:*:*:*:*:*). The root cause class is CWE-284 (Improper Access Control), meaning the system fails to correctly enforce authorization boundaries - a low-privileged principal can issue HTTP requests that bypass intended access restrictions and retrieve data beyond their authorization scope. The 'Authentication Bypass' tag suggests the bypass operates at the authorization layer rather than the authentication layer: credentials are required, but the access control logic improperly grants reads to restricted data once a session is established.
RemediationAI
Apply Oracle's April 2026 Critical Patch Update (CPU), which addresses this vulnerability; the advisory is available at https://www.oracle.com/security-alerts/cpuapr2026.html. Oracle CPUs are cumulative, so applying the April 2026 CPU to PeopleSoft Enterprise FIN Maintenance Management 9.2 constitutes the primary and recommended fix. No independently confirmed exact patched version number is available beyond the CPU release itself - consult the Oracle advisory for bundle patch details. If immediate patching is not feasible, implement compensating controls: restrict access to the Work Order Management component to only users with a verified business need using PeopleSoft role-based security; audit all low-privileged accounts for unnecessary FIN MM access and revoke excess permissions; and monitor PIA access logs for anomalous data retrieval patterns by low-privileged accounts. Note that role restriction reduces exposure but does not eliminate the underlying access control flaw.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today