CVE-2026-34280
Privilege Escalation in Oracle PeopleSoft Job Profile Manager
Publication date: 2026-04-21
Last updated on: 2026-04-23
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | peoplesoft_enterprise_hcm_human_resources | 9.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the PeopleSoft Enterprise HCM Human Resources product, specifically in the Job Profile Manager component. It affects version 9.2 and can be exploited by a high privileged attacker who has network access via HTTP.
The vulnerability allows such an attacker to compromise the system by unauthorized creation, deletion, or modification of critical data or any data accessible within PeopleSoft Enterprise HCM Human Resources.
How can this vulnerability impact me? :
Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible within PeopleSoft Enterprise HCM Human Resources.
This means an attacker could create, delete, or modify important data without permission, potentially causing data integrity issues and compromising confidentiality.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a high privileged attacker with network access to compromise PeopleSoft Enterprise HCM Human Resources, potentially leading to unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all accessible data.
Such unauthorized access and modification of sensitive data could negatively impact compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls over the confidentiality and integrity of personal and sensitive information.