CVE-2026-61087 in PeopleSoft Enterprise FIN Payables
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise FIN Payables product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Payables. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Payables accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle PeopleSoft Enterprise FIN Payables component, specifically targeting the security framework of version 9.2. The flaw represents a critical access control weakness that enables unauthenticated attackers to exploit network-based HTTP connections without requiring any prior authentication credentials or privileged access. The vulnerability's ease of exploitation stems from its design flaw that fails to properly validate incoming requests, creating an entry point for malicious actors to bypass standard authentication mechanisms.
The technical nature of this vulnerability aligns with CWE-287 which addresses improper authentication issues in software systems. Attackers can leverage this weakness through standard network protocols using HTTP connections to gain unauthorized access to sensitive financial data within the PeopleSoft environment. The CVSS 3.1 scoring system rates this vulnerability at 7.5 out of 10, with the confidentiality impact category receiving the highest weight due to the potential for complete data exposure. This classification indicates that successful exploitation could result in unauthorized access to all accessible data within the financial payables system, potentially including sensitive financial records, vendor information, and transaction details.
From an operational perspective, this vulnerability presents a severe risk to organizations utilizing PeopleSoft Enterprise FIN Payables as it allows attackers to compromise critical financial data without any authentication requirements. The attack surface is particularly concerning because it leverages standard HTTP protocols that are commonly used within enterprise environments, making detection more challenging for security monitoring systems. Organizations may experience significant financial loss and regulatory compliance issues if this vulnerability is exploited, given the sensitive nature of payable transactions and related financial information.
The impact of exploitation extends beyond simple data access to encompass potential business disruption and reputational damage. According to ATT&CK framework category T1190, this vulnerability represents a network service exploitation technique that can lead to initial access and lateral movement within the enterprise network. Organizations should implement immediate mitigations including network segmentation to restrict HTTP access to the affected component, deployment of web application firewalls, and regular security updates from Oracle. Additionally, organizations should conduct comprehensive network monitoring to detect unauthorized access attempts and establish incident response procedures specifically addressing financial data breaches. The vulnerability highlights the importance of maintaining current security patches and implementing defense-in-depth strategies to protect critical enterprise applications from unauthenticated access attempts.