Oracle PeopleSoft EUVD-2026-47432

Exploitation requires the attacker to have access to the physical/logical communication segment attached to the hardware where PeopleSoft Enterprise FIN Common Objects Argentina 9.1 runs (CVSS AV:A) - this is the concrete, non-negotiable prerequisite and the primary limiting factor, ruling out routable remote internet attacks. Within that segment, no authentication is needed (PR:N), no user interaction is required (UI:N), and complexity is low (AC:L), so any unauthenticated host on the adjacent segment against the affected 9.1 eSettlements deployment can attempt it. Additional limiter: only version 9.1 with the FIN Common Objects Argentina module is in scope, so environments without this Argentina localization module deployed are not affected.

Signals are mixed and lean toward moderate real-world priority despite the high 8.2 base score. Positive risk drivers: AC:L (low complexity), PR:N (no authentication), UI:N (no user interaction), S:C (scope change), and C:H (full read of accessible data) - an easily executed attack once the attacker is positioned. The key limiter is AV:A: the attacker must already have access to the adjacent physical communication segment attached to the host, which excludes untrusted remote internet attackers and materially reduces exposure. Integrity impact is only Low (I:L, partial writes) and availability is None (A:N). EPSS is not provided, there is no CISA KEV listing, no SSVC decision data, and no public exploit identified - so there is no evidence of active or automatable exploitation. Net: a genuine concern for internal/network-adjacent threat models (malicious insider, compromised segment, or lateral movement) but not an internet-facing emergency. Note the CWE is N/A, so the root-cause class is inferred only from the vendor's 'Authentication Bypass' tag and is not authoritatively confirmed.

An attacker who has gained a foothold on the internal network segment attached to the PeopleSoft Financials host - for example a malicious insider or an actor who pivoted from a compromised adjacent system - sends crafted traffic to the eSettlements module without any credentials. Exploiting the authentication-bypass weakness, they read confidential financial data across accessible records and perform limited unauthorized inserts, updates, or deletes, with the scope change allowing impact to spill into related PeopleSoft products. No public exploit code is identified at this time, so this reflects the low-complexity potential rather than an observed campaign.