Peoplesoft Enterprise Hcm Human Resources
Monthly
Unauthorized data access in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (French Public Sector Specific component) lets a remote, unauthenticated attacker read all HR-accessible data and modify a subset of it over HTTP. Oracle's July 2026 CPU rates it easily exploitable with high confidentiality and low integrity impact (CVSS 3.1 base 8.2), and third-party intel tags it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Integrity and availability compromise in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (Core component) allows a network-based, unauthenticated attacker to create, delete or modify critical data and to trigger a complete, repeatable denial of service. The flaw is rated CVSS 7.4 and is fixed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis, and confidentiality is not impacted. Despite requiring no authentication, the CVSS vector flags high attack complexity (AC:H), which meaningfully raises the bar for reliable exploitation.
Oracle PeopleSoft Enterprise HCM Human Resources 9.2 exposes a Security component flaw that enables a low-privileged, network-accessible attacker to bypass access controls via Oracle Net, resulting in complete confidentiality and integrity compromise of all HCM HR data. The vulnerability permits unauthorized creation, deletion, and modification of critical HR records alongside full read access to all accessible data within the system. No public exploit has been identified at time of analysis, and the CVSS AC:H designation indicates specific, undisclosed preconditions must be met for successful exploitation.
PeopleSoft Enterprise HCM Human Resources 9.2 exposes critical HR data to unauthorized access and modification through a missing authentication control (CWE-306) in the Job Profile Manager component. High-privileged authenticated attackers with network HTTP access can read or modify all data accessible within the HCM module, including sensitive employee records and job profile configurations. No active exploitation is confirmed (CISA KEV absent, EPSS 0.03%), but the SSVC technical impact is rated 'total', indicating full data compromise potential upon successful exploitation.
Cross-site scripting or equivalent client-side injection in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 - specifically the Employee Snapshot component - enables a low-privileged authenticated attacker to compromise confidentiality and integrity of HR data and trigger a scope change affecting additional products, provided a victim user interacts with attacker-controlled content over HTTP. The CVSS 3.1 score is 5.4 Medium (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting the scope change that elevates impact beyond the directly vulnerable system. No public exploit code exists and EPSS is 0.03% (8th percentile), indicating very low likelihood of opportunistic exploitation at time of analysis.
Unauthenticated attackers can exploit a cross-site request forgery vulnerability in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 through the Company Directory/Org Chart Viewer component to read, modify, or delete sensitive employee data via HTTP with user interaction. The vulnerability requires a victim to click a malicious link but impacts multiple PeopleSoft products and modules beyond the initial target. No patch is currently available for this medium-severity issue (CVSS 6.1).
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Human Resources). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthorized data access in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (French Public Sector Specific component) lets a remote, unauthenticated attacker read all HR-accessible data and modify a subset of it over HTTP. Oracle's July 2026 CPU rates it easily exploitable with high confidentiality and low integrity impact (CVSS 3.1 base 8.2), and third-party intel tags it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Integrity and availability compromise in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (Core component) allows a network-based, unauthenticated attacker to create, delete or modify critical data and to trigger a complete, repeatable denial of service. The flaw is rated CVSS 7.4 and is fixed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis, and confidentiality is not impacted. Despite requiring no authentication, the CVSS vector flags high attack complexity (AC:H), which meaningfully raises the bar for reliable exploitation.
Oracle PeopleSoft Enterprise HCM Human Resources 9.2 exposes a Security component flaw that enables a low-privileged, network-accessible attacker to bypass access controls via Oracle Net, resulting in complete confidentiality and integrity compromise of all HCM HR data. The vulnerability permits unauthorized creation, deletion, and modification of critical HR records alongside full read access to all accessible data within the system. No public exploit has been identified at time of analysis, and the CVSS AC:H designation indicates specific, undisclosed preconditions must be met for successful exploitation.
PeopleSoft Enterprise HCM Human Resources 9.2 exposes critical HR data to unauthorized access and modification through a missing authentication control (CWE-306) in the Job Profile Manager component. High-privileged authenticated attackers with network HTTP access can read or modify all data accessible within the HCM module, including sensitive employee records and job profile configurations. No active exploitation is confirmed (CISA KEV absent, EPSS 0.03%), but the SSVC technical impact is rated 'total', indicating full data compromise potential upon successful exploitation.
Cross-site scripting or equivalent client-side injection in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 - specifically the Employee Snapshot component - enables a low-privileged authenticated attacker to compromise confidentiality and integrity of HR data and trigger a scope change affecting additional products, provided a victim user interacts with attacker-controlled content over HTTP. The CVSS 3.1 score is 5.4 Medium (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting the scope change that elevates impact beyond the directly vulnerable system. No public exploit code exists and EPSS is 0.03% (8th percentile), indicating very low likelihood of opportunistic exploitation at time of analysis.
Unauthenticated attackers can exploit a cross-site request forgery vulnerability in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 through the Company Directory/Org Chart Viewer component to read, modify, or delete sensitive employee data via HTTP with user interaction. The vulnerability requires a victim to click a malicious link but impacts multiple PeopleSoft products and modules beyond the initial target. No patch is currently available for this medium-severity issue (CVSS 6.1).
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Human Resources). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.