CVE-2026-71092: PeopleSoft Privilege Escalation Flaw

CVE-2026-71092 Overview

CVE-2026-71092 is a high severity vulnerability in the Oracle PeopleSoft Enterprise FIN Lease Administration product, specifically within the Lease Administration component. The affected supported version is 9.2. The flaw is classified under [CWE-284] Improper Access Control and allows a low-privileged attacker with local logon access to the infrastructure to compromise the application. Successful exploitation can result in unauthorized creation, modification, or deletion of critical data, and full read access to all data accessible by PeopleSoft Enterprise FIN Lease Administration. Because the vulnerability triggers a scope change, attacks may impact additional products beyond the vulnerable component.

Critical Impact
Attackers with local logon access can compromise data integrity and confidentiality across PeopleSoft Enterprise FIN Lease Administration and impact additional products due to scope change.

Affected Products

Oracle PeopleSoft Enterprise FIN Lease Administration 9.2
Component: Lease Administration
Additional products may be impacted due to scope change

Discovery Timeline

2026-08-18 - CVE-2026-71092 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71092

Vulnerability Analysis

The vulnerability resides in the Lease Administration component of Oracle PeopleSoft Enterprise FIN Lease Administration version 9.2. It is categorized as an Improper Access Control weakness [CWE-284]. An authenticated attacker holding low privileges on the underlying infrastructure can leverage the flaw to gain unauthorized access to protected functionality and data.

While the vulnerability originates in PeopleSoft Enterprise FIN Lease Administration, its exploitation causes a scope change. This means the impact extends beyond the initial vulnerable component and can affect adjacent Oracle products that share resources or trust boundaries with the Lease Administration module.

Successful exploitation results in complete compromise of confidentiality and integrity for all data accessible through PeopleSoft Enterprise FIN Lease Administration. Availability is not directly affected by the vulnerability.

Root Cause

The root cause is improper access control enforcement within the Lease Administration component. The application fails to correctly restrict access to sensitive functions or data based on the authenticated user's privilege level. Consult the Oracle Security Alert for authoritative technical details.

Attack Vector

Exploitation requires local access to the infrastructure hosting PeopleSoft Enterprise FIN Lease Administration. The attacker must possess valid low-privilege credentials to log on to the system. The attack complexity is high, indicating that exploitation depends on conditions beyond the attacker's direct control. No user interaction is required to trigger the vulnerable code path.

The vulnerability manifests through the improper access control mechanism in the Lease Administration workflows. Detailed exploitation vectors have not been publicly disclosed by Oracle. Refer to the vendor security alert for coordinated disclosure information.

Detection Methods for CVE-2026-71092

Indicators of Compromise

Unexpected creation, modification, or deletion of lease records or related financial data within PeopleSoft Enterprise FIN Lease Administration 9.2.
Local logon events from low-privileged accounts followed by anomalous access to Lease Administration functionality.
Cross-module data access originating from the Lease Administration component that crosses expected trust boundaries.

Detection Strategies

Audit PeopleSoft application logs for unauthorized access attempts to Lease Administration components by low-privileged accounts.
Correlate operating system logon events on PeopleSoft infrastructure with application-level activity in the Lease Administration module.
Monitor database query patterns for unusual read or write operations against Lease Administration tables outside of normal business workflows.

Monitoring Recommendations

Enable and centralize PeopleSoft audit trails, including PSACCESSLOG and component-level tracing for Lease Administration.
Forward host and application telemetry from PeopleSoft servers to a SIEM for correlation and long-term retention.
Establish behavioral baselines for authenticated users interacting with the Lease Administration module and alert on deviations.

How to Mitigate CVE-2026-71092

Immediate Actions Required

Apply the security patch from the Oracle Security Alert covering PeopleSoft Enterprise FIN Lease Administration 9.2.
Inventory all PeopleSoft Enterprise FIN Lease Administration 9.2 deployments and prioritize patching based on exposure and data sensitivity.
Review and restrict local logon rights on infrastructure hosting PeopleSoft Enterprise FIN Lease Administration to only required accounts.

Patch Information

Oracle has published remediation guidance in the August 2026 Critical Security Patch Update. Administrators should review the Oracle Security Alert for patch identifiers, applicability, and installation instructions specific to PeopleSoft Enterprise FIN Lease Administration 9.2.

Workarounds

Enforce the principle of least privilege for accounts with logon access to PeopleSoft infrastructure.
Restrict network and host-level access to PeopleSoft application servers to trusted administrators and required service accounts.
Increase auditing and monitoring on Lease Administration components until the vendor patch is fully deployed.

bash

# Configuration example
# Review users with local logon rights on PeopleSoft application servers (Linux)
last -a | awk '{print $1}' | sort -u

# Review PeopleSoft audit configuration in psappsrv.cfg
grep -i "Log Fence\|TraceSQL\|TracePC" $PS_HOME/appserv/*/psappsrv.cfg