CVE-2026-71112 in PeopleSoft Enterprise FIN Common Objects
Summary
by MITRE • 08/19/2026
Vulnerability in the PeopleSoft Enterprise FIN Common Objects product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Common Objects. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in Oracle PeopleSoft Enterprise FIN Common Objects version 9.2 represents a critical security flaw within the application's Security component. This defect allows an unauthenticated attacker to compromise the integrity, confidentiality, and availability of the system by exploiting network access via HTTP. Although the exploitation difficulty is rated as high due to specific environmental or technical constraints requiring precise conditions, the potential impact remains severe. The CVSS 3.1 base score of 8.1 indicates a High severity level, reflecting significant consequences across all three pillars of information security when the vulnerability is successfully leveraged.
From a technical perspective, this flaw falls under the category of improper access control or authentication bypass mechanisms within the PeopleSoft framework. The attacker does not require valid credentials to initiate an attack, which classifies it as an unauthenticated vector. By sending specially crafted HTTP requests, the adversary can manipulate security objects that are intended to be protected by strict authorization checks. This failure in validation allows the execution of unauthorized operations or access to sensitive data structures within the FIN Common Objects module. The vulnerability aligns with CWE-287 Improper Authentication and potentially CWE-915 Improvement of Improper Control of Dynamically-Managed Code Resources, depending on whether the exploit involves code injection or privilege escalation through object manipulation.
The operational impact of this vulnerability is substantial because successful exploitation leads to a complete takeover of PeopleSoft Enterprise FIN Common Objects. This means an attacker could gain administrative-level access, allowing them to modify financial data, exfiltrate sensitive corporate information, disrupt business operations by altering configurations, or install additional malicious payloads such as web shells for persistent access. The high availability impact suggests that the system may be rendered unusable through denial-of-service techniques enabled by this flaw, while confidentiality and integrity impacts imply direct risks of data theft and tampering with financial records. This scenario is consistent with ATT&CK technique T1078 Valid Accounts if the attacker escalates privileges after initial access, or T1190 Exploit Public-Facing Application for the initial entry point via HTTP services exposed to the network.
Mitigation strategies must focus on immediate isolation and patching. Organizations running PeopleSoft Enterprise FIN Common Objects version 9.2 should apply the latest security patches provided by Oracle as soon as they are available, specifically targeting updates that address this specific CVE. In the interim, if patching is not immediately feasible, network-level controls such as Web Application Firewalls (WAF) can be configured to detect and block anomalous HTTP requests associated with exploitation attempts. Additionally, restricting direct internet-facing access to PeopleSoft servers by placing them behind a secure gateway or intranet-only environment reduces the attack surface significantly. Regular security audits and penetration testing should also be conducted to identify any other potential weaknesses in authentication logic within the FIN Common Objects module.