This vulnerability exists in the Workflow component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61-8.62. It is exploitable remotely over the network with low privileges and requires user interaction. Successful exploitation results in unauthorized read and modification (update, insert, delete) of accessible PeopleSoft Enterprise PeopleTools data. The CVSS 3.1 base score is 5.4, reflecting medium severity with impacts on confidentiality and integrity. The vulnerability scope extends beyond PeopleTools to potentially impact additional Oracle products. No known exploits in the wild have been reported. Oracle’s April 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this CVE.

Successful exploitation can lead to unauthorized read access to some PeopleSoft Enterprise PeopleTools data and unauthorized update, insert, or delete operations on that data. This compromises confidentiality and integrity of the affected data but does not impact availability. The vulnerability requires user interaction and low privileges, increasing the attack complexity. The scope of impact may extend beyond PeopleSoft Enterprise PeopleTools to other Oracle products.

Oracle’s April 2026 Critical Patch Update advisory recommends applying the latest security patches promptly. However, the advisory does not explicitly confirm a patch for CVE-2026-34307. Therefore, patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpuapr2026.html for current remediation guidance. Customers should remain on actively supported versions and apply Critical Patch Updates without delay to mitigate this and other vulnerabilities.