Oracle PeopleSoft EUVD-2026-47298

Exploitation requires network HTTP access to an internet- or network-exposed PeopleSoft Enterprise FIN Payables 9.2 deployment (the PIA web tier) running the affected Security component; the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication, no user interaction, and no special privileges are needed against an affected default installation. The primary limiting factor is reachability: the PIA endpoint must be accessible to the attacker, so deployments confined to internal segments or behind VPN/allowlists are far harder to reach. Exploitation is also bounded to the specific 9.2 version and the Payables module, and impact is confidentiality-only (read access) - the flaw does not by itself permit data modification or service disruption.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes an easily exploitable, network-reachable, unauthenticated read-only exposure - high confidentiality impact with no integrity or availability effect. There is no EPSS score, no SSVC decision, and no KEV listing in the provided data, so exploitation probability cannot be quantified; the absence of these signals means the 7.5 is a real-but-unproven priority rather than a confirmed active threat. The 'Authentication Bypass' tag reinforces the PR:N assessment, so the auth-free precondition is internally consistent. Because impact is confidentiality-only, this is a data-exposure risk (financial records, vendor/payment data) rather than a system-takeover risk; organizations exposing PIA to untrusted networks should treat it as higher priority than those with PeopleSoft restricted to internal segments.

An attacker who can reach the PeopleSoft PIA web interface over HTTP sends a crafted request to the FIN Payables application that bypasses the authentication/authorization check, and the server returns accounts-payable data - such as vendor records, invoice or payment details - without any login. Because no user interaction, credentials, or elevated privileges are required and complexity is low, the request can be issued directly and repeated to harvest data. No public proof-of-concept has been identified in the provided intelligence.