Description
Vulnerability in the PeopleSoft Enterprise FIN Project Costing product of Oracle PeopleSoft (component: Projects). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Project Costing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Project Costing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-04-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized access to sensitive data
Action: Patch Immediately
AI Analysis

Impact

A vulnerability in Oracle PeopleSoft Enterprise FIN Project Costing allows an attacker with low privileges and network access via HTTP to read critical data that should be restricted. Successful exploitation results in a confidentiality breach where the attacker can retrieve or view all data available in the PeopleSoft environment.

Affected Systems

This issue affects Oracle Corporation's PeopleSoft Enterprise FIN Project Costing version 9.2. The affected product is part of the Oracle PeopleSoft suite.

Risk and Exploitability

The CVSS v3.1 base score of 6.5 indicates moderate severity, primarily impacting confidentiality. The EPSS score is not available, but the description states the vulnerability is easily exploitable over an HTTP connection from the network. This attack does not require user interaction and relies on a low privilege attacker, making it a viable threat. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on April 22, 2026 at 06:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Download and install the Oracle security patch for PeopleSoft Enterprise FIN Project Costing 9.2 from the Oracle Critical Patch Update for April 2026.
  • Reconfigure network or firewall rules to limit HTTP access to the PeopleSoft instance to trusted internal hosts only.
  • Enable logging for access control violations and monitor logs for any unauthorized access attempts to the Projects component.

Generated by OpenCVE AI on April 22, 2026 at 06:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Apr 2026 07:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Exploitation Enabling Confidentiality Breach in Oracle PeopleSoft FIN Project Costing
Weaknesses CWE-284

Wed, 22 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise FIN Project Costing product of Oracle PeopleSoft (component: Projects). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Project Costing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Project Costing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Fin Project Costing
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_fin_project_costing:9.2:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Fin Project Costing
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Fin Project Costing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-04-22T13:23:23.934Z

Reserved: 2026-03-26T19:48:45.679Z

Link: CVE-2026-34306

cve-icon Vulnrichment

Updated: 2026-04-22T13:23:15.542Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-21T21:16:35.997

Modified: 2026-04-24T14:26:52.500

Link: CVE-2026-34306

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T06:45:10Z

Weaknesses