CVE-2026-34295

MediumCVSS 6.5

Published: 21/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

Vulnerability in PeopleSoft Enterprise SCM Purchasing (component: Purchasing) affecting version 9.2. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all accessible data.

Risk Assessment

Low exploitation barrier and HTTP access increase the risk of purchasing data leakage. This may compromise the confidentiality of supplier and order information.

Recommendation

Apply the Oracle patch for PeopleSoft Enterprise SCM Purchasing 9.2 and restrict network access to the application and account privileges.

Other vulnerabilities in PeopleSoft Enterprise SCM Purchasing

CVE-2026-91481Medium
Vulnerability in the Supplier Registration component of PeopleSoft Enterprise SCM Purchasing (Oracle PeopleSoft) affecting version 9.2. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on some data and unauthorized read access to a subset of data; the attack requires user interaction and may impact additional products (scope change).

Original NVD description (English source)

Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Purchasing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Purchasing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS