EUVD-2026-47028
GHSA-jm34-x5jp-cf38
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
Network vector via HTTP confirmed; AC:H per Oracle 'difficult to exploit'; PR:L for authenticated low-privilege access; no confidentiality impact per description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Mexico product of Oracle PeopleSoft (component: Global Payroll for Mexico). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Global Payroll Mexico. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Global Payroll Mexico accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise HCM Global Payroll Mexico. CVSS 3.1 Base Score 5.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L).
AnalysisAI
Integrity and partial availability compromise in Oracle PeopleSoft Enterprise HCM Global Payroll Mexico 9.2 is reachable by low-privileged network attackers over HTTP, though exploitation requires high complexity to trigger. Successful exploitation enables unauthorized creation, deletion, or modification of critical payroll data, as well as a partial denial of service against the Global Payroll Mexico component. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the Oracle CPU July 2026 advisory confirms the issue and presumably includes a patch.
Technical ContextAI
The affected component is the Global Payroll for Mexico module within Oracle PeopleSoft Enterprise HCM version 9.2 - a large-scale enterprise Human Capital Management platform commonly deployed on-premises or via Oracle Cloud. The attack vector is HTTP, indicating the vulnerable component is exposed through PeopleSoft's PIA (PeopleSoft Internet Architecture) web tier. No CWE is disclosed by Oracle, which is consistent with Oracle's standard practice of withholding root-cause details. The CVSS vector (AV:N/AC:H/PR:L) indicates a network-reachable flaw that requires a low-privilege authenticated session and involves elevated exploitation complexity, suggesting a race condition, multi-step manipulation, or a specific application state that must be satisfied to trigger the flaw. The impacts are confined to Integrity (High) and Availability (Low) with no Confidentiality impact, pointing to a data manipulation or state-corruption flaw rather than information disclosure.
RemediationAI
The primary remediation is to apply the patch delivered in the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs are cumulative for PeopleSoft, so customers should apply the full July 2026 CPU bundle for PeopleSoft HCM 9.2. An exact patched build number is not independently confirmed from available data. While awaiting the patch, compensating controls include restricting access to the Global Payroll for Mexico component to only those users with a legitimate business need via PeopleSoft role-based access controls, reducing the pool of accounts that satisfy the PR:L prerequisite. Additionally, enabling PeopleSoft audit logging on payroll transactions can help detect unauthorized modifications early. Disabling the Global Payroll Mexico component entirely is a viable but high-impact workaround only for organizations not actively running Mexico payroll cycles.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today