CVE-2026-61238 in PeopleSoft Enterprise FIN Common Objects Argentina
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Argentina. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Common Objects Argentina accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Argentina accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise FIN Common Objects Argentina component version 9.1, specifically within the eProcurement module of the broader PeopleSoft suite. The flaw represents a critical security weakness that allows unauthenticated attackers to exploit network-based HTTP connections and gain significant unauthorized access privileges. The vulnerability's ease of exploitation means that malicious actors with no prior authentication credentials can potentially compromise entire data repositories without requiring any special access rights or privileged accounts.
The technical nature of this vulnerability stems from inadequate authorization controls within the web application layer, permitting attackers to perform unauthorized operations against sensitive financial data objects. According to CVSS 3.1 scoring methodology, this vulnerability achieves a base score of 9.1, which classifies it as highly critical with high confidentiality and integrity impacts. The attack vector requires only network access via HTTP protocol, making it particularly dangerous as it can be exploited from remote locations without requiring physical presence or specialized tools beyond standard web browsing capabilities.
The operational impact of this vulnerability extends far beyond simple data theft, as successful exploitation enables attackers to create, delete, or modify critical financial data within the PeopleSoft system. This comprehensive access allows unauthorized modification of financial records, procurement processes, and other sensitive business data that forms the backbone of enterprise financial operations. The potential for data corruption, loss, or manipulation creates significant business continuity risks and regulatory compliance issues for organizations relying on PeopleSoft for their financial management systems.
Organizations affected by this vulnerability face substantial risk of financial fraud, data breaches, and operational disruption that could result in regulatory penalties under frameworks such as SOX compliance requirements. The lack of authentication requirements means that attackers can potentially access all accessible data within the system without detection, making this a particularly dangerous vulnerability for enterprise environments where financial data integrity is paramount. Security teams should immediately implement network segmentation controls to restrict HTTP access, deploy web application firewalls, and consider emergency patching strategies while conducting thorough forensic analysis of any potential exploitation attempts.
The vulnerability aligns with CWE-285 (Improper Authorization) and maps to ATT&CK techniques involving initial access through web application attacks and privilege escalation. Organizations should treat this as a high-priority remediation item in their security posture assessment, implementing both immediate defensive measures and long-term architectural improvements to prevent similar authorization bypass vulnerabilities from occurring in other system components.