CVE-2026-61078 in Common Application Objects
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Common Application Objects). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise CC Common Application Objects, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CC Common Application Objects accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle PeopleSoft Enterprise CC Common Application Objects component version 9.2, representing a significant security weakness that can be exploited by low-privileged attackers with network access through HTTP protocols. The vulnerability's exploitability is classified as easily achievable, indicating that attackers do not require advanced technical skills or specialized tools to leverage this flaw. The attack vector specifically requires network connectivity via HTTP, making it accessible to threat actors who can reach the target system through standard web protocols.
The technical nature of this vulnerability involves a privilege escalation path that allows attackers to gain unauthorized access to critical data and system resources within the PeopleSoft environment. This particular weakness operates at the application layer where common application objects are processed, enabling attackers to manipulate core components that control data access and modification capabilities. The vulnerability's impact extends beyond its immediate component scope, as successful exploitation can affect additional products within the broader PeopleSoft ecosystem through what is termed a "scope change" effect.
The operational consequences of this vulnerability are severe and multifaceted, with potential for unauthorized creation, deletion, or modification of critical data within the affected systems. Attackers could gain complete access to all data accessible through PeopleSoft Enterprise CC Common Application Objects, potentially compromising sensitive business information, financial records, employee data, or other confidential corporate assets. The CVSS 3.1 base score of 8.7 reflects the high severity impact with confidentiality and integrity implications rated as high, indicating that successful exploitation could result in significant data compromise and system integrity violations.
This vulnerability aligns with CWE-284 (Improper Access Control) and potentially CWE-79 (Cross-Site Scripting) depending on implementation details, representing a classic access control flaw where insufficient authorization checks allow unauthorized modifications to application objects. From an attack perspective, this vulnerability maps to ATT&CK technique T1078 (Valid Accounts) and potentially T1566 (Phishing) if human interaction is required for exploitation, suggesting that attackers may need to leverage social engineering or account compromise tactics to achieve successful exploitation.
Mitigation strategies should prioritize immediate patching of the affected PeopleSoft version 9.2, implementation of network segmentation to limit access to critical application components, and enhanced monitoring of HTTP traffic for suspicious activities related to Common Application Objects. Organizations should also consider implementing additional authentication controls, least privilege access models, and regular security assessments of their PeopleSoft environments. The requirement for human interaction indicates that user education and awareness programs should be strengthened to prevent successful exploitation attempts through social engineering approaches, while network-level controls can help detect and prevent unauthorized access attempts to the vulnerable application objects.