CVE-2026-22006

CVE-2026-22006 is a vulnerability in Oracle PeopleSoft Enterprise HCM Human Resources (Employee Snapshot component), affecting version 9.2. The flaw allows low-privileged attackers with network access to compromise the application and potentially impact additional connected products through scope changes. The vulnerability has a CVSS 3.1 score of 5.4 (Medium severity) and is easily exploitable via HTTP. It requires low user privileges and user interaction from a third party, but carries moderate confidentiality and integrity impacts, allowing unauthorized read access and modification of sensitive HCM data. The attack vector is network-based with low complexity. Exploitation status indicates minimal current threat activity. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog and shows an extremely low EPSS score of 0.00027, suggesting no active exploitation in the wild. Community attention appears limited, with an inactive status on exploit tracking lists.