What is the CVSS score of CVE-2026-61057?

CVE-2026-61057 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

PeopleSoft eSettlements CVE-2026-61057

EUVD-2026-47270 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-3jf7-x4fh-33wq

Authentication Bypass Oracle Peoplesoft Enterprise Fin Esettlements

4.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

Network-accessible HTTP attack requiring no privileges but high complexity conditions; limited confidentiality and integrity impact only, no availability impact, no scope change.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:29 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN eSettlements product of Oracle PeopleSoft (component: eSettlements). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN eSettlements. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN eSettlements accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN eSettlements accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

PeopleSoft Enterprise FIN eSettlements 9.2 exposes financial settlement data to unauthenticated network attackers via an HTTP-accessible authentication bypass, enabling limited unauthorized read access and write manipulation of settlement records. Carrying a CVSS 3.1 score of 4.8 with high attack complexity (AC:H), exploitation is not trivial and resists easy automation, but the financial nature of the affected data - electronic payments and settlement instructions - amplifies business risk well beyond the moderate numeric score. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept has been identified at the time of this analysis.

Technical ContextAI

PeopleSoft Enterprise FIN eSettlements is Oracle's electronic settlements module within the PeopleSoft Financial Management suite, deployed by large enterprises and government entities to process high-value vendor and intercompany payment transactions. The vulnerability is hosted within the eSettlements component of PeopleSoft's PIA (PeopleSoft Internet Architecture), which exposes application functionality over HTTP. Oracle has not assigned a CWE, but the analyst-applied 'Authentication Bypass' tag indicates a flaw in access control or session validation logic - likely a weakness in how the application authenticates or authorizes HTTP requests to protected eSettlements endpoints. The AC:H rating suggests exploitation may depend on specific request sequencing, timing, or knowledge of application-internal state rather than a static, replayable payload. Affected version is confirmed as 9.2, per Oracle CPU July 2026 and ENISA EUVD-2026-47270.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html, through the Oracle My Oracle Support portal where patch IDs and exact build versions are confirmed. The precise patched version number is not independently available in current intelligence - consult Oracle My Oracle Support for the specific patch number applicable to PeopleSoft Enterprise FIN eSettlements 9.2. As a compensating control prior to patching, restrict HTTP access to PeopleSoft PIA eSettlements endpoints via perimeter firewall or WAF rules, limiting reachability to known authorized IP ranges; this directly negates the network attack vector (AV:N) and is highly effective given AC:H. Additionally, enforce VPN or network segmentation requirements for any access to PeopleSoft financial modules. Monitor eSettlements audit logs for anomalous unauthenticated access attempts or unexpected data mutations in settlement records.