CVE-2026-61204
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise FIN Program Management product of Oracle PeopleSoft (component: Primavera Integration). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Program Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise FIN Program Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Program Management. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise FIN Program Management version 9.2, specifically within the Primavera Integration component, representing a critical security flaw that poses significant operational risks to enterprise environments. The vulnerability's classification as easily exploitable indicates that attackers can leverage relatively straightforward techniques to gain unauthorized access, making it particularly dangerous in production environments where such systems handle sensitive financial and program management data. The attack vector requires network access via HTTP, suggesting that the vulnerability could be exploited from external networks without requiring physical access or specialized local privileges.
The technical nature of this flaw allows a low-privileged attacker to compromise the target system through network-based HTTP connections, demonstrating that insufficient access controls or authentication mechanisms exist within the Primavera Integration component. The CVSS 3.1 base score of 9.0 reflects the severity of potential impacts across all three core security principles: confidentiality, integrity, and availability. This high scoring indicates that successful exploitation could result in complete system compromise where attackers gain full control over the PeopleSoft Enterprise FIN Program Management application. The vector notation (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) reveals that the attack requires network access with low complexity, only low privilege requirements, but necessitates user interaction from someone other than the attacker, suggesting a social engineering or targeted approach may be required.
The scope change aspect of this vulnerability indicates that while the initial attack targets PeopleSoft Enterprise FIN Program Management, successful exploitation could potentially impact additional products within the Oracle PeopleSoft ecosystem, creating cascading security risks across interconnected systems. This broader impact potential makes the vulnerability particularly concerning for organizations with integrated enterprise applications where data flows between multiple modules and systems. The requirement for human interaction suggests that this may be a targeted attack involving phishing or other social engineering techniques where users are tricked into performing actions that facilitate the exploit, aligning with tactics described in the MITRE ATT&CK framework under initial access and execution phases.
Organizations should implement immediate mitigations including network segmentation to limit access to the affected system, enhanced monitoring of HTTP traffic for suspicious patterns, and comprehensive user education programs to reduce social engineering risks. The vulnerability's classification as a critical issue with high impact potential necessitates urgent remediation efforts, potentially involving patch management procedures or temporary network isolation until proper security updates can be deployed. Security teams should also conduct thorough risk assessments to identify other systems that may be impacted by this scope change and implement additional controls around user access privileges and system monitoring. This type of vulnerability typically aligns with CWE categories related to insufficient authentication and improper access control mechanisms, emphasizing the need for robust identity management and privilege escalation prevention measures within enterprise financial applications.