CVE-2026-61239
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Argentina. While the vulnerability is in PeopleSoft Enterprise FIN Common Objects Argentina, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Common Objects Argentina accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Common Objects Argentina accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Common Objects Argentina. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle PeopleSoft Enterprise FIN Common Objects Argentina component, specifically within the eProcurement module of the PeopleSoft suite. The flaw represents a critical security weakness that affects version 9.1 of the software, making it susceptible to exploitation by unauthenticated attackers who can access the system through standard HTTP network protocols. The vulnerability's classification as easily exploitable indicates that attackers require minimal technical expertise or resources to leverage this weakness effectively.
The technical nature of this flaw stems from insufficient authentication and authorization controls within the PeopleSoft eProcurement framework, allowing malicious actors to bypass normal security restrictions. This weakness creates a pathway for unauthorized users to gain access to sensitive financial data and operational systems without requiring valid credentials. The vulnerability operates at the application layer, specifically targeting the communication protocols used by PeopleSoft applications to process business transactions and manage procurement workflows.
From an operational impact perspective, this vulnerability presents severe consequences for organizations utilizing Oracle PeopleSoft systems. Successful exploitation enables attackers to execute unauthorized modifications to critical financial data including the ability to create, delete, or modify sensitive records within the PeopleSoft environment. The compromise extends beyond simple data access, as attackers can also achieve partial denial of service conditions that disrupt normal business operations and procurement processes. Organizations may experience significant disruption to their financial management systems and procurement workflows.
The security implications extend beyond the immediate component through scope change effects that can impact additional products within the PeopleSoft ecosystem. This cascading effect means that exploitation of this single vulnerability can potentially compromise multiple interconnected systems and data repositories within the enterprise environment. The CVSS 3.1 base score of 9.9 reflects the high severity of this weakness, with impacts spanning confidentiality, integrity, and availability aspects of information security.
The attack vector analysis reveals that network-based exploitation requires no prior privileges or user interaction, making this vulnerability particularly dangerous for organizations with exposed web services. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L) indicates a network-accessible vulnerability with low attack complexity and no privilege requirements, while the scope change component suggests that the impact extends beyond the initially targeted system. This vulnerability aligns with CWE categories related to insufficient authentication mechanisms and weak access controls.
Organizations should implement immediate mitigations including network segmentation to limit access to PeopleSoft applications, application firewalls to monitor and filter HTTP traffic, and comprehensive patch management procedures to address this vulnerability. Security monitoring should focus on unusual access patterns and unauthorized data modifications within the procurement and financial systems. Regular security assessments and vulnerability scanning should be conducted to identify similar weaknesses across the broader PeopleSoft infrastructure. The ATT&CK framework would categorize this vulnerability under initial access and privilege escalation techniques, emphasizing the need for robust network perimeter controls and application-level security measures to prevent unauthorized system compromise and maintain business continuity.