A critical vulnerability in Oracle PeopleSoft Enterprise HCM Talent Acquisition Manager allows authenticated attackers to gain full system control and potentially compromise associated infrastructure.

This vulnerability resides in the Job Opening component and allows a low privileged, authenticated attacker with network access to exploit the system. The flaw is rated with a CVSS score of 9.9, indicating an extreme risk to confidentiality, integrity, and availability.

The potential for a total takeover of the Talent Acquisition Manager poses a severe threat to human resources data and organizational operations. Because the vulnerability allows for scope changes, an attacker could potentially pivot to compromise other integrated enterprise systems. The high CVSS score reflects the ease of exploitation and the catastrophic impact on the application environment.

Immediate Action: Apply the relevant patches provided in the July 2026 Oracle Critical Patch Update immediately.

Proactive Monitoring: Review application access logs for unusual administrative activity or unauthorized attempts to access the Job Opening component.

Compensating Controls: Deploy Web Application Firewall rules to filter malicious HTTP traffic and restrict access to the affected component to trusted internal segments only.

Public Exploit Available: No

Given the critical CVSS severity of 9.9, organizations must prioritize the installation of vendor-supplied patches. Failure to remediate this flaw exposes the enterprise to complete system compromise and potential lateral movement across the PeopleSoft environment.