Oracle PeopleSoft EUVD-2026-47268

Exploitation requires the attacker to have valid logon access to the infrastructure where PeopleSoft Enterprise SCM Order Management 9.2 executes (AV:L) and a low-privileged account on that system (PR:L), with no user interaction required (UI:N) and low attack complexity (AC:L). The affected feature is specifically the Security component of the Order Management module in version 9.2. Limiting factors that reduce real-world risk: the vulnerability is NOT remotely exploitable over the network - an attacker cannot trigger it without first authenticating to or gaining local access on the application infrastructure - so exposure is confined to insiders and post-compromise scenarios, and only the 9.2 release is stated as affected.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: exploitation is local (attacker must already have logon access to the infrastructure), low complexity, requires low privileges, needs no user interaction, and delivers high impact to all three security properties. This is a genuine escalation-to-takeover risk for anyone with a foothold, but the AV:L requirement materially limits exposure compared with a network-facing flaw - a pre-existing authenticated account or host access is a hard prerequisite, so mass or remote exploitation is not feasible. No EPSS score was provided and the CVE is not in CISA KEV, and no POC is referenced, so all real-world exploitation signals are currently absent or unknown. Net priority: a real patch-worthy issue for organizations running PeopleSoft SCM 9.2, but not an emergency drop-everything item absent evidence of active exploitation; the local vector means it is realistically an insider or post-compromise escalation vector rather than an internet-borne threat.

An attacker who already holds a low-privileged PeopleSoft or infrastructure logon - for example a rank-and-file employee account or a foothold gained through phishing - abuses the weakness in the Order Management Security component to escalate to full control of the module. From there they can read, alter, or destroy order and supply-chain data and disable the service. No user interaction and no public exploit code are needed, and the low attack complexity means a knowledgeable insider or post-compromise attacker could act reliably.