Peoplesoft Enterprise Fin Project Costing
Monthly
Full takeover of Oracle PeopleSoft Enterprise FIN Project Costing 9.2 (Projects component) is achievable by an attacker with logon access to the host infrastructure, exploiting a local flaw that requires tricking a legitimate user into performing an action. Per the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R), exploitation is local and low-complexity but gated on human interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was reported by Oracle and fixed in the July 2026 Critical Patch Update.
Unauthorized full data disclosure in PeopleSoft Enterprise FIN Project Costing 9.2 allows a low-privileged authenticated attacker to read all data accessible to the Projects component via a network-reachable HTTP endpoint. The root cause is improper access control (CWE-284), tagged by Oracle as an authentication bypass - most likely an authorization boundary failure that permits privilege escalation within the application rather than a bypass of the initial login gate, consistent with a PR:L CVSS vector. No public exploit code has been identified and EPSS is 0.03% (9th percentile), indicating negligible automated exploitation activity at this time.
Vulnerability in the PeopleSoft Enterprise FIN Project Costing component of Oracle PeopleSoft Products (subcomponent: Projects). Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.
Full takeover of Oracle PeopleSoft Enterprise FIN Project Costing 9.2 (Projects component) is achievable by an attacker with logon access to the host infrastructure, exploiting a local flaw that requires tricking a legitimate user into performing an action. Per the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R), exploitation is local and low-complexity but gated on human interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was reported by Oracle and fixed in the July 2026 Critical Patch Update.
Unauthorized full data disclosure in PeopleSoft Enterprise FIN Project Costing 9.2 allows a low-privileged authenticated attacker to read all data accessible to the Projects component via a network-reachable HTTP endpoint. The root cause is improper access control (CWE-284), tagged by Oracle as an authentication bypass - most likely an authorization boundary failure that permits privilege escalation within the application rather than a bypass of the initial login gate, consistent with a PR:L CVSS vector. No public exploit code has been identified and EPSS is 0.03% (9th percentile), indicating negligible automated exploitation activity at this time.
Vulnerability in the PeopleSoft Enterprise FIN Project Costing component of Oracle PeopleSoft Products (subcomponent: Projects). Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.