CVE-2026-22006
Unauthorized Data Modification via Network Access in PeopleSoft Employee Snapshot
Publication date: 2026-04-21
Last updated on: 2026-04-23
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | peoplesoft_enterprise_hcm_human_resources | 9.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the PeopleSoft Enterprise HCM Human Resources product, specifically in the Employee Snapshot component. It allows a low privileged attacker with network access via HTTP to compromise the system. The attack requires human interaction from someone other than the attacker. Successful exploitation can lead to unauthorized update, insertion, or deletion of some accessible data, as well as unauthorized read access to a subset of accessible data within PeopleSoft Enterprise HCM Human Resources.
How can this vulnerability impact me? :
The impact of this vulnerability includes unauthorized modification (update, insert, delete) and unauthorized reading of certain data within PeopleSoft Enterprise HCM Human Resources. This can compromise the confidentiality and integrity of the data. Since the scope of the attack can extend beyond just the Human Resources product, additional related products may also be significantly impacted.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthorized read and modification access to some data within PeopleSoft Enterprise HCM Human Resources, which could lead to exposure or alteration of sensitive personal information.
Such unauthorized access and data manipulation may impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and health information against unauthorized access and ensuring data integrity.
However, the provided information does not explicitly state the direct effects on compliance with these standards.