What is the CVSS score of EUVD-2026-47287?

EUVD-2026-47287 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle PeopleSoft HCM are affected by EUVD-2026-47287?

Oracle PeopleSoft Enterprise HCM Talent Acquisition Manager 9.2 is vulnerable to a critical flaw enabling attackers to gain complete control of your talent management system with potential spillover…

How to fix or mitigate EUVD-2026-47287?

Within 24 hours, identify all instances of PeopleSoft HCM Talent Acquisition Manager 9.2 in your environment and document dependencies with interconnected modules; simultaneously prepare a detailed asset inventory and risk assessment. Over the following 7 days, implement network segmentation to restrict access to the Job Opening component, enable enhanced logging and monitoring for suspicious access patterns, deploy intrusion detection signatures for CVE-2026-61076, and apply application controls limiting module interactions to verified business-critical users only. Within 30 days, establish expedited procedures for emergency patching once Oracle releases a fix, prepare contingency plans including potential temporary system isolation if business continuity permits, and evaluate whether temporary migration to alternate talent management solutions is feasible to reduce exposure window.

Oracle PeopleSoft HCM EUVD-2026-47287

| CVE-2026-61076 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-3r6v-mppw-9j6r

Privilege Escalation Oracle Peoplesoft Enterprise Hcm Talent Acquisition Manager

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network HTTP reach with low complexity, a required low-privileged account (PR:L), and a scope change yielding full C/I/A takeover across connected modules.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:57 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Manager product of Oracle PeopleSoft (component: Job Opening). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Talent Acquisition Manager. While the vulnerability is in PeopleSoft Enterprise HCM Talent Acquisition Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise HCM Talent Acquisition Manager. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle PeopleSoft Enterprise HCM Talent Acquisition Manager 9.2 is achievable by a low-privileged, network-based attacker abusing the Job Opening component over HTTP. Because the flaw carries a scope change (S:C), successful attacks reach beyond the Talent Acquisition module and can significantly impact additional connected PeopleSoft products. No public exploit identified at time of analysis, but the 9.9 CVSS and trivial exploitability make this a top-priority patch from Oracle's July 2026 Critical Patch Update.

Technical ContextAI

PeopleSoft Enterprise HCM Talent Acquisition Manager is Oracle's recruiting/applicant-tracking module within the broader PeopleSoft HCM suite, delivered over the PeopleSoft Internet Architecture (PIA) - a Java/Tuxedo web application stack fronted by HTTP. The vulnerable Job Opening component processes recruiting-requisition data submitted by authenticated users. Oracle assigns no CWE (CWE: N/A) and its advisories are intentionally sparse, but the combination of a scope-changing takeover reachable by a low-privileged HTTP user is consistent with an authorization/injection weakness in the application tier that lets a user pivot to the underlying application server context shared across PeopleSoft modules.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory; no discrete fix version is enumerated in the input beyond the CPU) as documented at https://www.oracle.com/security-alerts/cpujul2026.html - Oracle strongly recommends applying CPU patches without delay and treats them as the primary remediation. As compensating controls until patching completes, restrict network access to the PeopleSoft PIA/Job Opening functionality to trusted networks or VPN only (reduces the AV:N exposure at the cost of blocking remote recruiter access), tighten and audit low-privileged PeopleSoft account provisioning since exploitation requires an authenticated account (trade-off: administrative overhead), and place a WAF or reverse proxy in front of PIA to inspect and rate-limit requests to the recruiting components (trade-off: possible false positives on legitimate requisition workflows). Do not rely on these controls as a substitute for the CPU patch given the total-takeover impact.