CVE-2026-61072
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise FIN Staffing Front Office Brazil product of Oracle PeopleSoft (component: Staffing). The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Staffing Front Office Brazil. While the vulnerability is in PeopleSoft Enterprise FIN Staffing Front Office Brazil, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Staffing Front Office Brazil. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise FIN Staffing Front Office Brazil component version 9.1, representing a critical security flaw that demonstrates characteristics of a remote code execution vector through HTTP network access. The vulnerability's exploitability is rated as easily accessible, requiring only low privileged attacker credentials and network connectivity to potentially compromise the targeted system. The CVSS 3.1 scoring of 9.9 indicates the highest severity level with complete impacts across confidentiality, integrity, and availability domains, making this a particularly dangerous threat vector within enterprise financial systems.
The technical flaw manifests as a weakness in the PeopleSoft staffing front office application that processes HTTP requests, allowing unauthorized attackers to gain full control over the affected system. This vulnerability operates through a network-based attack surface where malicious actors can leverage HTTP protocols to execute malicious code or commands against the vulnerable server. The scope of impact extends beyond just the directly targeted component, as indicated by the scope change designation in the CVSS vector, meaning that successful exploitation could potentially compromise additional Oracle products within the same environment. The low privilege requirement combined with network accessibility creates a significant risk for organizations that do not implement proper network segmentation or application hardening measures.
The operational implications of this vulnerability are severe and multifaceted, as it provides attackers with complete system takeover capabilities that can result in data breaches, financial fraud, system corruption, and service disruption. Organizations utilizing PeopleSoft Enterprise FIN Staffing Front Office Brazil may face catastrophic consequences including unauthorized access to sensitive financial data, manipulation of staffing records, and potential disruption of critical business processes. The confidentiality impact is rated as high because attackers could gain access to proprietary financial information and employee data, while the integrity impact indicates the ability to modify or corrupt system data, and availability impact suggests potential denial of service scenarios that could halt business operations.
Organizations should implement immediate mitigations including applying Oracle's security patches and updates, implementing network segmentation to limit access to the affected systems, deploying web application firewalls to monitor and filter HTTP traffic, and conducting comprehensive vulnerability assessments to identify any additional exposed components. The ATT&CK framework would categorize this vulnerability under initial access and execution techniques, specifically leveraging web application vulnerabilities for system compromise. According to CWE classification, this vulnerability likely falls within categories related to insufficient input validation or improper error handling in web applications, making it critical to address through both immediate patching and long-term security architecture improvements. Security teams should also consider implementing monitoring solutions that can detect anomalous HTTP traffic patterns and unauthorized access attempts to the affected components, as well as establishing incident response procedures specifically tailored to handle such high-severity vulnerabilities in financial enterprise applications.