PeopleSoft FIN Management EUVD-2026-47408

Exploitation requires a valid low-privileged PeopleSoft account (PR:L) with HTTP network access to the Primavera Integration component of PeopleSoft Enterprise FIN Program Management 9.2, and it requires human interaction from a person other than the attacker (UI:R) - typically a separate authenticated user who must be induced to interact with attacker-supplied content. The limiting factors are therefore twofold: the attacker cannot be fully unauthenticated (some account is needed) and cannot succeed without a second victim user acting, which rules out silent, automatable, unauthenticated mass exploitation. Only version 9.2 with the Primavera Integration component in use is in scope; deployments not using that integration are not exposed through this vector.

The signals indicate a genuine high priority but not an emergency. The 9.0 score is driven mainly by the scope change (S:C) and triple-high impact, while AC:L and PR:L lower the bar; however, UI:R means the attacker cannot act alone and must trick a person other than themselves, which meaningfully cuts mass-exploitation potential. There is no CISA KEV listing and no POC referenced, so this is neither confirmed actively exploited nor known to have public exploit code. No EPSS score was provided, so exploitation probability cannot be quantified from the input, and no SSVC decision data was supplied. The 'low privileged attacker' phrasing matches CVSS PR:L, so a valid (even minimal) PeopleSoft account is required, confining the threat to those with application access. Net: patch on Oracle's normal CPU cadence with elevated urgency due to the scope-change takeover potential, but the required user interaction and nonzero privilege requirement temper real-world exploitability.

A user holding a low-privilege PeopleSoft account crafts malicious content and sends a link or embedded request to a higher-value PeopleSoft user; when that victim, already authenticated, interacts with it over HTTP, the payload executes in their session against the Primavera Integration component and, via the scope change, reaches connected Oracle products. No public exploit code is identified at time of analysis, so the attacker relies on social engineering to trigger the required human interaction.