EUVD-2026-47269
GHSA-xvf8-m7m7-22vj
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-delivered HTTP bypass with no credentials required; high complexity per Oracle characterization; limited partial confidentiality and integrity impact, no availability or scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise FIN Grants product of Oracle PeopleSoft (component: Grants). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Grants. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Grants accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Grants accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Partial authentication bypass in Oracle PeopleSoft Enterprise FIN Grants 9.2 exposes limited data read and write capabilities to unauthenticated network attackers over HTTP. Exploitation is rated difficult (AC:H), meaning the attacker must satisfy specific, unstated preconditions to succeed, constraining real-world risk despite the absence of authentication requirements. Impact is bounded: only a subset of Grants data is accessible for reading, and unauthorized inserts, updates, or deletes are limited to some accessible data - full database compromise is not implied. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
Oracle PeopleSoft Enterprise is a large-scale ERP platform widely deployed in higher education, public sector, and government environments. The FIN Grants component manages grant lifecycle, funding, and compliance workflows. The vulnerability is tagged as an Authentication Bypass, consistent with the CVSS PR:N metric indicating no credentials are required, yet delivered over the HTTP interface (AV:N). No CWE is assigned, which limits root-cause characterization; however, authentication bypass classes typically involve flawed session validation, insecure direct object references, or improperly protected API endpoints. The AC:H metric suggests exploitation requires a non-default or timing-sensitive condition - such as a race condition, specific application state, or knowledge of internal resource identifiers - rather than a trivially repeatable attack. Affected CPE is implicitly PeopleSoft Enterprise FIN Grants version 9.2 based on EUVD data.
RemediationAI
Apply the Oracle Critical Patch Update (CPU) for July 2026, which addresses this vulnerability for PeopleSoft Enterprise FIN Grants 9.2. The advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle does not publicly disclose exact patch build numbers outside of My Oracle Support, so organizations should consult MOS for the specific patch ID. As a compensating control prior to patching, restrict network access to the PeopleSoft HTTP interface using perimeter firewall rules or network segmentation, limiting exposure to trusted internal subnets only - note that this does not eliminate risk if attackers have internal network access. Additionally, review PeopleSoft Grants component access logs for anomalous unauthenticated HTTP requests as a detection measure. There is no indication that disabling the Grants component is operationally feasible without service disruption, so patching remains the primary remediation path.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today