Oracle PeopleSoft EUVD-2026-47412

Exploitation requires network reachability to the PeopleSoft Enterprise SCM Manufacturing 9.2 web interface over HTTPS (the PIA web tier); no authentication is required (PR:N, consistent with the Authentication Bypass tag) and no user interaction is needed (UI:N). The key limiting factor is high attack complexity (AC:H): Oracle explicitly classifies this as 'difficult to exploit,' indicating the attacker must meet conditions beyond their control (e.g., specific configuration, state, or timing) rather than firing a single deterministic request. Only version 9.2 of this specific SCM Manufacturing module is affected, and realistic exposure is limited to instances whose web tier is reachable by the attacker; internal-only deployments substantially reduce risk.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, score 7.4) describes a network-reachable, unauthenticated flaw with high confidentiality and integrity impact but high attack complexity (AC:H), which materially lowers real-world exploitability - Oracle explicitly labels it 'difficult to exploit,' implying non-trivial conditions or timing that an attacker must satisfy. There is no EPSS score, no SSVC decision, and no CWE provided in the input, so automatability and technical-impact framing cannot be independently derived. Crucially, it is NOT in CISA KEV and no POC is referenced, so despite the 'Authentication Bypass' tag this should be treated as a patch-in-normal-cycle priority rather than an emergency, weighted upward only for internet-exposed PeopleSoft instances holding sensitive manufacturing/supply-chain data. Note the conflict worth verifying: the 'Authentication Bypass' tag suggests easy access, yet AC:H indicates exploitation is hard - confirm the exact preconditions with Oracle's advisory before deprioritizing.

A remote attacker with no credentials sends specially crafted HTTPS requests to an internet-exposed PeopleSoft Enterprise SCM Manufacturing 9.2 instance, leveraging the authentication-bypass weakness in the Security component to reach protected data operations. Once past authentication, the attacker reads sensitive manufacturing and supply-chain records and can create, alter, or delete critical data. The high attack complexity (AC:H) means the attacker must satisfy specific, non-trivial conditions to succeed, and no public POC is currently known.