CVE-2026-34309
Unauthorized Access Vulnerability in Oracle PeopleSoft Security Module
Publication date: 2026-04-21
Last updated on: 2026-04-24
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | peoplesoft_enterprise_peopletools | 8.61 |
| oracle | peoplesoft_enterprise_peopletools | 8.62 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft, specifically in the Security component. It affects supported versions 8.61 to 8.62. The vulnerability is easily exploitable by a low privileged attacker who has network access via HTTP.
Successful exploitation allows the attacker to compromise PeopleSoft Enterprise PeopleTools, leading to unauthorized creation, deletion, or modification of critical data or any data accessible through PeopleSoft Enterprise PeopleTools.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including unauthorized access to critical data or complete access to all data accessible through PeopleSoft Enterprise PeopleTools.
- Unauthorized creation, deletion, or modification of critical data.
- Compromise of confidentiality and integrity of sensitive information.
- Potential exposure of sensitive business or personal data managed within PeopleSoft.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthorized creation, deletion, or modification of critical data and unauthorized access to all accessible data within PeopleSoft Enterprise PeopleTools. Such unauthorized access and data manipulation can lead to violations of data protection requirements under common standards and regulations like GDPR and HIPAA, which mandate strict controls over data confidentiality and integrity.
Because the vulnerability impacts confidentiality and integrity of data (CVSS score 8.1), organizations using affected versions may face increased risk of non-compliance with these regulations if exploited.