CVE-2026-34300

MEDIUM

Oracle PeopleSoft Enterprise FIN Contracts 9.2 - Info Disclosure

Title source: llm

Description

Vulnerability in the PeopleSoft Enterprise FIN Contracts product of Oracle PeopleSoft (component: Contracts). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Contracts. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Contracts accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

References (1)

[Vendor Advisory] https://www.oracle.com/security-alerts/cpuapr2026.html

Scores

CVSS v3 6.5

EPSS 0.0004

EPSS Percentile 12.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-200

Status published

Products (2)

oracle/peoplesoft_enterprise_fin_contracts 9.2

Oracle Corporation/PeopleSoft Enterprise FIN Contracts 9.2

Published Apr 21, 2026

Tracked Since Apr 22, 2026