CVE-2026-34307: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

CVE-2026-34307 is an improper access control vulnerability in the Workflow component of Oracle PeopleSoft Enterprise PeopleTools, affecting versions 8.61 and 8.62. It was disclosed on April 21, 2026, as part of Oracle's April 2026 Critical Patch Update (CPU). The vulnerability allows a low-privileged attacker with network access via HTTP to perform unauthorized data operations, with a scope change that may impact additional connected products. It carries a CVSS v3.1 base score of 5.4 (Medium) (Oracle CPU Apr 2026, Github Advisory).

The vulnerability is classified under CWE-284 (Improper Access Control), indicating that the Workflow component of PeopleTools fails to properly restrict access to resources for unauthorized actors (Github Advisory). Exploitation requires a low-privileged attacker with network access via HTTP and necessitates human interaction from a victim (e.g., clicking a malicious link or interacting with attacker-controlled content). The changed scope indicates that a successful attack can affect resources beyond the vulnerable PeopleTools component itself, potentially impacting other integrated Oracle products. No public technical write-ups or proof-of-concept code have been identified at this time (Oracle CPU Apr 2026).

Successful exploitation can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data, as well as unauthorized update, insert, or delete operations on that data, affecting both confidentiality and integrity. Availability is not impacted. Due to the scope change, connected or downstream Oracle products integrated with PeopleTools may also be affected, potentially expanding the blast radius beyond the directly vulnerable component (Oracle CPU Apr 2026, Github Advisory).

Oracle has addressed this vulnerability in the April 2026 Critical Patch Update (CPU). Organizations running PeopleSoft Enterprise PeopleTools versions 8.61 or 8.62 should apply the relevant patches from the April 2026 CPU immediately (Oracle CPU Apr 2026). As a temporary measure, Oracle recommends blocking network protocols required by the attack and restricting user permissions to minimize exposure, though neither approach is a long-term substitute for patching. Additionally, security awareness training to prevent users from interacting with untrusted content can reduce the risk of exploitation given the required user interaction precondition.