CVE-2026-61237
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Integration). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Argentina. While the vulnerability is in PeopleSoft Enterprise FIN Common Objects Argentina, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Argentina accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Common Objects Argentina accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Common Objects Argentina. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise FIN Common Objects Argentina component, specifically within the integration framework of the PeopleSoft financial suite. The flaw represents a critical security weakness that affects version 9.1 of the product, making it susceptible to exploitation by unauthenticated attackers who can access the system through standard HTTP protocols. The vulnerability's classification as easily exploitable indicates that attackers require minimal technical skill or resources to leverage this weakness effectively.
The technical nature of this vulnerability stems from insufficient authentication and authorization controls within the integration layer of PeopleSoft Enterprise FIN Common Objects Argentina. This allows malicious actors to bypass normal security boundaries without requiring valid credentials, creating an unrestricted access point that can be exploited across network connections. The attack vector through HTTP protocols means that the vulnerability is accessible from external networks, potentially exposing organizations to remote exploitation.
The operational impact of this vulnerability extends beyond the immediate PeopleSoft Enterprise FIN Common Objects Argentina product, as indicated by the scope change designation that affects additional products within the Oracle PeopleSoft ecosystem. Successful exploitation can result in comprehensive data breaches where attackers gain unauthorized access to critical financial information and sensitive business data stored within the system. The compromise also includes the ability to modify or delete data, potentially causing significant integrity violations in financial records and transactional data.
Furthermore, the vulnerability enables attackers to perform unauthorized updates, inserts, and deletions against accessible data within the PeopleSoft environment, creating potential for data corruption or manipulation that could severely impact financial reporting accuracy. The partial denial of service component means that attackers can disrupt system availability, affecting business operations and potentially causing financial losses through service interruptions. This combination of confidentiality, integrity, and availability impacts places this vulnerability at a critical severity level with a CVSS base score of 9.9.
Organizations should implement immediate mitigations including network segmentation to restrict HTTP access to PeopleSoft systems, deploying web application firewalls to monitor and filter traffic, and applying the latest Oracle security patches. Additional protective measures include implementing strong authentication mechanisms, conducting regular vulnerability assessments, and establishing robust monitoring for unusual access patterns. The vulnerability aligns with CWE-287 (Improper Authentication) and potentially CWE-312 (Sensitive Data Exposure) categories, while threat actors may leverage techniques from the ATT&CK framework related to initial access and credential access phases. This vulnerability demonstrates the critical importance of maintaining up-to-date security configurations in enterprise financial systems where unauthorized access can result in significant financial and operational consequences.