CVE-2026-71092: PeopleSoft Lease Administration Auth Bypass

CVE-2026-71092 Overview

CVE-2026-71092 is a broken access control vulnerability [CWE-284] in Oracle PeopleSoft Enterprise FIN Lease Administration version 9.2. The flaw resides in the Lease Administration component and allows a low-privileged, locally authenticated attacker to compromise confidentiality and integrity of the application. Exploitation is difficult but results in a scope change, meaning attacks may impact resources beyond the vulnerable component. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, and unauthorized read access to all data accessible through PeopleSoft Enterprise FIN Lease Administration. Oracle disclosed the issue in the Oracle Security Alert of August 2026.

Critical Impact
Authenticated local attackers can read, modify, or delete all data accessible through PeopleSoft FIN Lease Administration, with a scope change that may affect adjacent PeopleSoft components.

Affected Products

Oracle PeopleSoft Enterprise FIN Lease Administration 9.2
Component: Lease Administration
Deployments where the attacker has logon access to the PeopleSoft infrastructure

Discovery Timeline

2026-08-18 - CVE-2026-71092 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database
2026-08-23 - EPSS score published at 0.088% (percentile 0.461)

Technical Details for CVE-2026-71092

Vulnerability Analysis

The vulnerability affects the Lease Administration component of Oracle PeopleSoft Enterprise FIN Lease Administration 9.2. It is classified under Improper Access Control [CWE-284]. An attacker requires low privileges and local logon access to the infrastructure hosting the application. Exploitation is described as difficult, indicating that specific conditions or timing may be needed to trigger the flaw. Once exploited, the attacker gains unauthorized read, write, and delete access to data managed by the Lease Administration component. The scope change indicator shows that the impact extends beyond the vulnerable component to additional PeopleSoft resources under a different security authority.

Root Cause

The root cause is improper enforcement of access controls within the Lease Administration module. The module fails to validate whether an authenticated user with limited privileges is authorized to perform sensitive read and write operations on lease data and adjacent PeopleSoft objects. Oracle has not published detailed root-cause information beyond the Oracle Security Alert August 2026.

Attack Vector

An attacker must first authenticate to the PeopleSoft infrastructure with a low-privileged account. From that local context, the attacker interacts with the Lease Administration component to bypass authorization checks. Because the scope changes, the compromised data may include resources managed by other PeopleSoft components rather than only the Lease Administration module. No user interaction is required, and no publicly available exploit code has been observed.

No verified proof-of-concept code has been released. Refer to the Oracle Security Alert August 2026 for vendor technical details.

Detection Methods for CVE-2026-71092

Indicators of Compromise

Unexpected creation, modification, or deletion of lease records by low-privileged PeopleSoft user accounts
Access to PeopleSoft data outside a user's assigned role or business unit
Anomalous session activity from application service accounts touching Lease Administration objects

Detection Strategies

Audit PeopleSoft application logs for authorization failures followed by successful access to the same object
Correlate low-privileged account activity with data changes in PS_LA_* lease administration tables
Baseline normal user roles against actual data access patterns and flag deviations

Monitoring Recommendations

Enable and centralize PeopleSoft audit trails for the Lease Administration component into a SIEM
Monitor operating system and database logon events on infrastructure hosting PeopleSoft FIN
Alert on privilege boundary violations that indicate scope-change exploitation across PeopleSoft modules

How to Mitigate CVE-2026-71092

Immediate Actions Required

Apply the patches provided in the Oracle Critical Patch Update referenced by the Oracle Security Alert August 2026
Inventory all PeopleSoft Enterprise FIN Lease Administration 9.2 deployments and prioritize internet-adjacent or shared environments
Review and reduce standing local logon privileges on PeopleSoft application and database hosts

Patch Information

Oracle addressed CVE-2026-71092 in its August 2026 security update. Administrators must apply the fix specific to PeopleSoft Enterprise FIN Lease Administration 9.2 as documented in the Oracle Security Alert August 2026. No workaround is a substitute for the vendor patch.

Workarounds

Restrict local logon rights to PeopleSoft infrastructure to a minimum set of administrators
Enforce least privilege on PeopleSoft roles and permission lists that grant access to Lease Administration
Segment the PeopleSoft application tier from general-purpose user networks until patched

bash

# Configuration example: audit and restrict local logon on PeopleSoft hosts (Linux)
# Review users with interactive shell access
awk -F: '$7 !~ /nologin|false/ {print $1}' /etc/passwd

# Enforce PeopleSoft app-tier access via group membership only
sudo groupadd -f psft_admins
sudo usermod -aG psft_admins <admin_user>

# Enable auditd rules for PeopleSoft install directory
sudo auditctl -w /opt/psft -p rwxa -k psft_access