CVE-2026-61070 in PeopleSoft Enterprise FIN Common Objects Argentina
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Cash Management). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Argentina. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Common Objects Argentina. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise FIN Common Objects Argentina component version 9.1, specifically within the Cash Management module of the broader PeopleSoft financial suite. The flaw represents a security weakness that can be exploited by unauthenticated attackers who gain network access through HTTP protocols. The vulnerability's classification as easily exploitable indicates that minimal technical expertise or resources are required to launch successful attacks against affected systems. This accessibility significantly increases the risk profile and potential impact across organizations utilizing this specific PeopleSoft component.
The technical nature of this vulnerability manifests as a weakness in the authentication and authorization mechanisms within the Cash Management functionality, allowing unauthorized actors to exploit network-based access points without requiring valid credentials or privileged accounts. The CVSS 3.1 base score of 5.3 reflects the moderate severity level with availability impacts being the primary concern, specifically indicating partial denial of service conditions that can disrupt normal operational capabilities. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) confirms that this vulnerability is remotely exploitable over network connections with low attack complexity, no privilege requirements, and no user interaction needed, while the unspecified scope suggests potential impact across multiple system components.
From an operational standpoint, successful exploitation of this vulnerability can result in partial denial of service conditions that affect the availability of critical financial management functions within PeopleSoft Enterprise FIN Common Objects Argentina. This disruption can significantly impact business operations by preventing authorized users from accessing cash management capabilities, potentially causing delays in financial processing, reporting issues, and reduced overall system reliability. The partial nature of the denial of service suggests that while complete system shutdown may not occur, critical functionality remains compromised and operational continuity is affected.
Organizations should implement immediate mitigations including network segmentation to restrict access to PeopleSoft components, deployment of web application firewalls to monitor and filter HTTP traffic, and regular patch management procedures to address known vulnerabilities. The vulnerability aligns with CWE-284 (Improper Access Control) and may map to ATT&CK techniques involving initial access through network services and privilege escalation. Additional defensive measures should include monitoring for suspicious network activity, implementing least privilege access controls, and conducting regular security assessments of PeopleSoft environments to identify potential exploitation vectors. System administrators should also consider disabling unnecessary HTTP endpoints and ensuring proper network access controls are implemented to reduce the attack surface available to potential adversaries.