The flaw is an improper privilege management weakness (CWE-306) that permits a user with high privileges and network access via HTTP to create, delete, or modify critical data within PeopleSoft Enterprise HCM Absence Management. Successful exploitation results in unauthorized modification of critical records and full data access, impacting both confidentiality and integrity of the system. The vulnerability’s nature is a privilege escalation via HTTP requests, allowing the attacker to bypass normal access controls.

Oracle Corporation’s PeopleSoft Enterprise HCM Absence Management version 9.2 is affected. No other versions are listed as susceptible.

The CVSS base score of 6.5 indicates medium severity. The EPSS score of 0.00054 (<1%) indicates a very low probability of exploitation, but the vulnerability is still exploitable by a high‑privilege actor with network access via HTTP. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is over the network using HTTP and requires the attacker to possess high‑privilege credentials within the PeopleSoft environment, which can lead to significant data integrity compromise.