CVE-2026-34266
Unauthorized Data Modification in Oracle PeopleSoft Absence Management
Publication date: 2026-04-21
Last updated on: 2026-04-23
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | peoplesoft_enterprise_human_capital_management_absence_management | 9.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the PeopleSoft Enterprise HCM Absence Management product of Oracle PeopleSoft, specifically in version 9.2. It is an easily exploitable flaw that allows a high privileged attacker with network access via HTTP to compromise the system.
Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within the PeopleSoft Enterprise HCM Absence Management system, or unauthorized access to all accessible data in this component.
How can this vulnerability impact me? :
The impact of this vulnerability includes unauthorized access to critical data and the ability to create, delete, or modify important information within the PeopleSoft Enterprise HCM Absence Management system.
This could compromise the confidentiality and integrity of your data, potentially leading to data breaches or manipulation of sensitive information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a high privileged attacker with network access to compromise PeopleSoft Enterprise HCM Absence Management, potentially resulting in unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all accessible data.
Such unauthorized access and modification of critical data could lead to violations of data protection standards and regulations like GDPR and HIPAA, which require strict controls over the confidentiality and integrity of sensitive personal and health information.
Therefore, exploitation of this vulnerability may negatively impact compliance with these regulations by exposing sensitive data to unauthorized parties and compromising data integrity.