Peoplesoft Enterprise Fin Payables
Monthly
Unauthenticated data disclosure in Oracle PeopleSoft Enterprise FIN Payables 9.2 (Security component) lets a remote attacker reach financial data over HTTP without credentials, yielding read access to critical or all data the Payables module can reach. The Oracle-supplied tag of 'Authentication Bypass' aligns with the CVSS PR:N vector, indicating the flaw circumvents access controls. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but its low complexity and network reach make it a credible target once details from the July 2026 CPU are studied.
Improper access control in the Payables component of Oracle PeopleSoft Enterprise FIN Payables 9.2 allows an authenticated, low-privileged user with network access over HTTP to read and modify a subset of Payables-accessible data and to partially degrade availability of the affected component. Exploitation requires valid low-tier credentials on the target system (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, base score 6.3), so it is not reachable by unauthenticated attackers; no public exploit code has been identified at time of analysis and EPSS is low at roughly 0.2% (9th percentile), indicating little observed exploitation activity. The practical threat is limited to insiders or attackers already holding low-privilege PeopleSoft accounts.
Vulnerability in the PeopleSoft Enterprise FIN Payables product of Oracle PeopleSoft (component: Financial Sanctions). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated data disclosure in Oracle PeopleSoft Enterprise FIN Payables 9.2 (Security component) lets a remote attacker reach financial data over HTTP without credentials, yielding read access to critical or all data the Payables module can reach. The Oracle-supplied tag of 'Authentication Bypass' aligns with the CVSS PR:N vector, indicating the flaw circumvents access controls. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but its low complexity and network reach make it a credible target once details from the July 2026 CPU are studied.
Improper access control in the Payables component of Oracle PeopleSoft Enterprise FIN Payables 9.2 allows an authenticated, low-privileged user with network access over HTTP to read and modify a subset of Payables-accessible data and to partially degrade availability of the affected component. Exploitation requires valid low-tier credentials on the target system (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, base score 6.3), so it is not reachable by unauthenticated attackers; no public exploit code has been identified at time of analysis and EPSS is low at roughly 0.2% (9th percentile), indicating little observed exploitation activity. The practical threat is limited to insiders or attackers already holding low-privilege PeopleSoft accounts.
Vulnerability in the PeopleSoft Enterprise FIN Payables product of Oracle PeopleSoft (component: Financial Sanctions). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.