Oracle PeopleSoft CVE-2026-61062

Exploitation requires an authenticated foothold: the attacker must have logon access to the infrastructure where PeopleSoft Enterprise FIN Cash Management 9.2 executes and hold at least a low-privilege account (PR:L), matching the local attack vector (AV:L). No user interaction is needed (UI:N) and complexity is low (AC:L), so once that access exists exploitation is straightforward. The specific affected feature is the Cash Management component of the FIN module at version 9.2. Limiting factors that reduce realistic risk: the flaw is not remotely reachable over the network, it cannot be triggered by a fully unauthenticated outsider, and it is bounded to supported version 9.2 - meaning defenders who control internal account provisioning and infrastructure logon rights substantially shrink the attack surface.

The CVSS 3.1 base score is 8.8 (High), but the vector tells a nuanced story: AV:L means exploitation requires local logon to the hosting infrastructure rather than remote network reach, and PR:L requires an existing low-privileged account, both of which materially reduce the population of capable attackers compared to a network-facing unauthenticated flaw. Offsetting this, AC:L (Oracle calls it 'easily exploitable'), UI:N, full C/I/A impact, and the S:C scope change push severity up because a single foothold can cascade into broader product compromise. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or automated exploitation - this reads as a real but insider/foothold-dependent priority rather than an internet-wide emergency. Note a mild tension to verify: the vendor tag says 'Information Disclosure' yet the vector asserts high Integrity and Availability impact plus takeover, so treat this as a full-compromise issue, not merely a data-leak.

A user with a low-privileged but valid account on the server infrastructure running PeopleSoft FIN Cash Management 9.2 - for example, a contractor, junior finance operator, or a compromised standard account - leverages the easily exploitable flaw (AC:L, no user interaction) to escalate and take over the Cash Management component. Owing to the scope change, the attacker then reaches beyond Cash Management to affect other co-hosted Oracle/PeopleSoft products, reading and altering financial data. No public exploit code is currently identified, so the scenario presumes an attacker who already holds an internal foothold.