CVE-2026-61056 in PeopleSoft Enterprise FIN Grants
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise FIN Grants product of Oracle PeopleSoft (component: Grants). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Grants. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Grants accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Grants accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability exists within Oracle PeopleSoft Enterprise FIN Grants version 9.2, representing a significant security weakness that affects the financial grants management component of the PeopleSoft suite. The flaw manifests as a difficulty in exploitation condition, meaning that while it requires specific circumstances to be successfully leveraged, the attack surface remains accessible to unauthenticated network-based adversaries who can initiate HTTP requests against the target system. The vulnerability's classification as a medium severity issue according to CVSS 3.1 scoring indicates that attackers can potentially gain unauthorized access to sensitive financial data through this vector.
The technical nature of this vulnerability allows for multiple types of unauthorized data manipulation within the grants management system. Specifically, successful exploitation enables attackers to perform unauthorized update, insert, or delete operations on certain portions of the accessible data repository, while simultaneously granting read access to a subset of the system's data. This dual impact on both integrity and confidentiality represents a substantial risk to financial grant administration processes where data accuracy and protection are paramount. The vulnerability's CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates that network access is required, the attack complexity is high, no prior privileges are necessary, user interaction is not required, and the scope remains unchanged, meaning the impact is contained within the affected component.
From an operational standpoint, this vulnerability poses significant risks to organizations relying on PeopleSoft Enterprise FIN Grants for financial administration. The compromised data could include sensitive grant information, beneficiary details, funding allocations, and financial transaction records that require protection under various regulatory frameworks including SOX compliance requirements. The potential for unauthorized modifications to grant data could result in financial loss, compliance violations, and operational disruption of critical grants management processes. Organizations may face audit findings and regulatory penalties if such vulnerabilities are exploited successfully.
The mitigation strategy should focus on implementing immediate network-level protections including firewall rules to restrict HTTP access to the affected system, ensuring proper patching of the PeopleSoft Enterprise FIN Grants component, and implementing network monitoring to detect suspicious HTTP traffic patterns. Security teams should also consider restricting access to sensitive data through additional authentication layers and implementing data loss prevention measures. Organizations must evaluate their current security posture against established frameworks such as CWE-284 for improper access control vulnerabilities and align their response with ATT&CK techniques related to credential access and privilege escalation. Regular vulnerability assessments and penetration testing should be conducted to identify similar weaknesses within the broader PeopleSoft environment and ensure comprehensive protection against evolving threat landscapes.
The affected system represents a critical business application where data integrity is essential for maintaining trust with grant recipients and regulatory compliance. The combination of unauthorized read and write capabilities creates a scenario where attackers could potentially manipulate grant distributions while simultaneously accessing confidential financial records, making this vulnerability particularly concerning for organizations managing substantial grant portfolios and sensitive financial information through the PeopleSoft platform.