Oracle PeopleSoft EUVD-2026-47279

Exploitation requires the attacker to already hold high application privileges within PeopleSoft (CVSS PR:H) and network access to the HTTP-exposed Billing component of the PeopleSoft Enterprise FIN Billing Argentina 9.1 module - i.e., an authenticated, elevated operator/administrator of the Financials application, not an anonymous internet user. No user interaction is needed (UI:N) and complexity is low (AC:L), but the deployment must be running the Argentina country-localization Billing package specifically; environments without this localized module are not affected. The high-privilege prerequisite is the primary limiting factor, confining realistic exploitation to malicious insiders or post-compromise privilege abuse.

The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - network-reachable and low-complexity, but gated behind high privileges (PR:H), which materially reduces real-world exploitability to insider or post-compromise scenarios. There is no EPSS score, no SSVC decision, and no CWE in the provided data, so automatability and technical-impact framing cannot be independently derived. It is not in CISA KEV (not actively exploited per available signals) and no POC is referenced, so this is a genuine High-impact issue but not an urgent internet-facing emergency: the PR:H requirement is the dominant limiting factor. The 'Information Disclosure' tag is consistent with the C:H rating but does not by itself indicate mass-exploitable exposure.

A malicious insider or an attacker who has already compromised a high-privilege PeopleSoft finance/Billing account sends crafted HTTP requests to the Billing component of the Argentina localization module. Because attack complexity is low, the request reliably triggers the flaw and results in full takeover of the FIN Billing Argentina application, exposing and altering billing/tax data. No public exploit code is currently identified.