CVE-2026-61073 in PeopleSoft Enterprise FIN Common Objects Brazil
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Brazil. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Brazil accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise FIN Common Objects Brazil component version 9.1, specifically affecting the Purchasing module. The flaw represents a significant security weakness that can be exploited by unauthenticated attackers without requiring any prior access credentials or privileges. The vulnerability is classified as easily exploitable due to its accessibility over standard HTTP network connections, making it particularly dangerous in environments where PeopleSoft applications are exposed to external networks.
The technical nature of this vulnerability stems from insufficient authentication and authorization controls within the purchasing component of the PeopleSoft financial suite. Attackers can leverage this weakness to gain unauthorized access to sensitive financial data and business-critical information stored within the system. The CVSS 3.1 scoring of 7.5 indicates a high severity impact with confidentiality being the primary affected security objective, while integrity and availability remain unaffected in this specific case. The attack vector AV:N indicates network-based exploitation, AC:L suggests low access complexity, and PR:N shows no privilege requirements for successful exploitation.
The operational impact of this vulnerability extends beyond simple data theft, as it can potentially lead to complete compromise of all accessible data within the PeopleSoft Enterprise FIN Common Objects Brazil environment. This includes sensitive financial records, vendor information, purchase orders, and other confidential business data that organizations rely on for their operations. Organizations running this specific version may face severe consequences including regulatory compliance violations, financial losses, competitive disadvantages, and potential legal ramifications from data breaches.
From a cybersecurity framework perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and maps to ATT&CK technique T1071.004 (Application Layer Protocol: DNS) when considering the network-based exploitation methods. The lack of authentication requirements makes this particularly concerning for organizations that have not implemented proper network segmentation or additional security controls such as web application firewalls, intrusion detection systems, or network access controls. Organizations should immediately implement patches provided by Oracle, consider network segmentation to limit exposure, and conduct thorough security assessments of their PeopleSoft environments to identify similar vulnerabilities across other components and versions.
The attack surface for this vulnerability is significant given the widespread use of PeopleSoft Enterprise FIN Common Objects Brazil in financial institutions, government agencies, and large corporations. Without proper mitigation measures, organizations face potential data exfiltration attacks that could compromise years of financial transaction history, vendor relationships, and business intelligence. Security teams should also consider implementing monitoring solutions to detect unusual access patterns or unauthorized data queries that might indicate exploitation attempts against this vulnerability.