CVE-2026-61243 in PeopleSoft Enterprise FIN Common Objects Argentina
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Staffing). The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Argentina. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Common Objects Argentina. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise FIN Common Objects Argentina component, specifically within the Staffing module of version 9.1. The flaw represents a critical security weakness that enables low-privileged attackers to gain unauthorized access to the system through HTTP network connections. The vulnerability's exploitability score of 8.8 on the CVSS 3.1 scale indicates a high-severity threat that can result in complete system compromise.
The technical nature of this vulnerability stems from insufficient access controls and authentication mechanisms within the PeopleSoft application framework. Attackers with minimal privileges can leverage this weakness to execute unauthorized operations against the staffing components, potentially gaining full administrative control over the affected system. The CVSS vector analysis reveals that this vulnerability requires low attack complexity, low privilege requirements, and no user interaction, making it particularly dangerous as it can be exploited remotely without requiring physical access or specialized tools.
The operational impact of this vulnerability extends beyond simple data compromise to encompass complete system takeover capabilities. Successful exploitation could enable attackers to modify staffing records, manipulate financial data, access sensitive employee information, and potentially disrupt business operations. Organizations utilizing PeopleSoft Enterprise FIN Common Objects Argentina may face significant regulatory compliance issues, data breaches, and financial losses due to unauthorized system access.
Mitigation strategies should include immediate patch application from Oracle, network segmentation to limit access to the affected components, implementation of robust firewall rules restricting HTTP access, and enhanced monitoring for suspicious activities. Organizations should also consider implementing additional authentication layers such as multi-factor authentication and regularly reviewing access controls to ensure least privilege principles are maintained. This vulnerability aligns with CWE-284 (Improper Access Control) and maps to ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing). The affected system requires immediate security assessment and remediation to prevent potential exploitation by threat actors seeking to compromise financial and personnel data within the PeopleSoft environment.