This vulnerability affects Oracle PeopleSoft Enterprise HCM Absence Management version 9.2. It is exploitable by a high privileged attacker with network access over HTTP and can lead to unauthorized creation, deletion, or modification of critical data within the affected product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no impact on availability. The vulnerability is documented in Oracle's April 2026 Critical Patch Update advisory, which includes numerous security patches but does not explicitly confirm a dedicated patch for this specific issue.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by PeopleSoft Enterprise HCM Absence Management 9.2. This compromises data confidentiality and integrity but does not impact system availability. The vulnerability requires a high privileged attacker with network access via HTTP, limiting the attack surface to users with elevated privileges.

Oracle's April 2026 Critical Patch Update advisory includes multiple security patches and strongly recommends customers apply these updates without delay. Although the advisory does not explicitly confirm a dedicated patch for CVE-2026-34266, applying the latest Critical Patch Update is the recommended mitigation. Customers should ensure they are running actively-supported versions and promptly apply Oracle's security patches to reduce risk.