CVE-2026-71092

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in PeopleSoft Enterprise FIN Lease Administration

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: Oracle

Description

Vulnerability in the PeopleSoft Enterprise FIN Lease Administration product of Oracle PeopleSoft (component: Lease Administration). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Lease Administration executes to compromise PeopleSoft Enterprise FIN Lease Administration. While the vulnerability is in PeopleSoft Enterprise FIN Lease Administration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Lease Administration accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Lease Administration accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-71092

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	peoplesoft_enterprise_fin_lease_administration	9.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle PeopleSoft Enterprise FIN Lease Administration version 9.2. It allows a low-privileged attacker with system access to compromise the application. The flaw enables unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all accessible data in the system.

Detection Guidance

Detection of this vulnerability requires checking for unauthorized modifications or access to critical data within the PeopleSoft Enterprise FIN Lease Administration system. Review system logs for unusual activities, such as unexpected data creation, deletion, or modification. Ensure the application is running the latest patched version and verify user privileges to identify any low-privileged accounts with excessive access.

Impact Analysis

An attacker could exploit this to alter or delete sensitive financial lease data, steal confidential information, or gain full access to the PeopleSoft system. This could disrupt business operations, lead to financial losses, or expose sensitive data to unauthorized parties.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data integrity and confidentiality requirements. For HIPAA, it risks exposing protected health information, potentially breaching compliance. Organizations may face legal penalties or loss of certification.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for PeopleSoft Enterprise FIN Lease Administration version 9.2 to address the vulnerability. Ensure only authorized users have logon access to the infrastructure where this component executes. Monitor for unauthorized data modifications or access attempts in the PeopleSoft system.

Hi! I’m here to help you understand CVE-2026-71092. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70