CVE-2026-61071 in PeopleSoft
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise FIN Engineering Argentina product of Oracle PeopleSoft (component: Engineering). The supported version that is affected is 9.1. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Engineering Argentina. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Engineering Argentina accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Engineering Argentina accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise FIN Engineering Argentina component version 9.1, representing a significant security weakness that can be exploited by attackers with elevated privileges and network access. The flaw resides in the web application layer where HTTP requests are processed, making it accessible to malicious actors who have already gained some level of administrative access or can establish network connectivity to the target system. The CVSS 3.1 base score of 3.3 indicates a low to medium severity vulnerability that specifically targets both confidentiality and integrity aspects of the affected system.
The technical nature of this vulnerability stems from insufficient input validation and access control mechanisms within the PeopleSoft application framework. Attackers with high privileged access can manipulate HTTP requests to gain unauthorized access to sensitive data within the engineering financial module. This includes the ability to perform unauthorized update, insert, or delete operations on specific data sets, as well as read access to a subset of accessible information. The vulnerability requires an attacker to already possess elevated privileges, suggesting it may be a privilege escalation issue rather than a straightforward authentication bypass.
The operational impact of this vulnerability extends beyond simple data compromise, as it can lead to financial data manipulation and unauthorized modifications that could affect business operations and compliance requirements. Organizations using PeopleSoft Enterprise FIN Engineering Argentina may face risks including unauthorized financial transactions, data corruption, or the exposure of sensitive engineering project information that could be valuable to competitors. The attack vector requiring network access via HTTP indicates that proper network segmentation and firewall rules are essential defensive measures, while the high privilege requirement suggests that internal threat actors pose a significant risk.
Security mitigations should focus on implementing comprehensive access control policies, regular security assessments of PeopleSoft applications, and ensuring proper patch management procedures are followed. Organizations must also consider network segmentation to limit access to critical financial systems and implement robust monitoring solutions to detect unauthorized access attempts. This vulnerability aligns with CWE-284 (Improper Access Control) and may be related to ATT&CK techniques involving privilege escalation and credential access. The CVSS vector analysis shows that while the attack complexity is high, the impact on data integrity and confidentiality remains significant enough to warrant immediate attention and remediation efforts.
The vulnerability demonstrates the importance of proper application security controls within enterprise financial systems where multiple layers of protection are essential. Regular vulnerability assessments, code reviews, and security testing should be implemented to identify similar weaknesses in PeopleSoft applications and other enterprise software solutions. Organizations should also consider implementing database activity monitoring and logging mechanisms that can detect unauthorized data modifications and access patterns that may indicate exploitation attempts against such vulnerabilities.