What is the CVSS score of CVE-2026-61068?

CVE-2026-61068 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-61068?

Oracle PeopleSoft FIN Billing Argentina 9.1 contains a critical vulnerability allowing complete system compromise by high-privilege internal users, jeopardizing revenue recognition, billing…

How to fix or mitigate CVE-2026-61068?

Within 24 hours: restrict administrative access to PeopleSoft FIN Billing Argentina 9.1 to essential personnel only, disable unnecessary high-privilege accounts, and audit recent administrative activity for anomalies. Within 7 days: deploy enhanced audit logging and real-time alerting for billing system configuration changes, conduct a privileged access review with finance leadership to document legitimate use cases, and establish a change approval process for billing operations. Within 30 days: contact Oracle for remediation roadmap and version upgrade guidance, evaluate privileged access management (PAM) solutions for billing system credentials, and plan migration from PeopleSoft 9.1 to a supported version.

Oracle PeopleSoft CVE-2026-61068

EUVD-2026-47279 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9jg3-26ph-pmv4

Authentication Bypass Oracle Peoplesoft Enterprise Fin Billing Argentina

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP reach with low complexity but requires pre-existing high application privilege (PR:H); full takeover gives C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:59 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Billing Argentina product of Oracle PeopleSoft (component: Billing). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Billing Argentina. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Billing Argentina. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise (takeover) of Oracle PeopleSoft Enterprise FIN Billing Argentina 9.1 is possible by a high-privileged attacker with network access over HTTP, per Oracle's July 2026 Critical Patch Update. Successful attacks yield complete confidentiality, integrity, and availability loss of the Billing component. No public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle rates the attack complexity as low (easily exploitable) once the required privileges are held.

Technical ContextAI

The affected component is the Billing module of Oracle PeopleSoft Enterprise Financials (FIN), specifically the Argentina country-localization package for tax/invoicing compliance. PeopleSoft is a Java/Tomcat-based enterprise ERP running on the PeopleTools application server and PIA (PeopleSoft Internet Architecture) web tier, typically fronted by WebLogic. Oracle did not assign a CWE (CWE: N/A) and characterizes the flaw only as enabling 'takeover' with Information Disclosure among the tagged effects; the precise root-cause class (e.g., injection, deserialization, or access-control flaw) is not disclosed in the available data. Because exploitation requires high privileges (PR:H), the flaw most plausibly represents a privilege-escalation or authorized-function-abuse path rather than an unauthenticated pre-auth bug.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory) documented at https://www.oracle.com/security-alerts/cpujul2026.html; no discrete fixed build number is provided in the input, so obtain the exact PeopleSoft/PeopleTools patch set from My Oracle Support for version 9.1. As compensating controls until patching, restrict which accounts hold high-privilege Billing roles (the exploit prerequisite) by reviewing PeopleSoft permission lists and roles, limit HTTP access to the PIA/Billing endpoints to trusted administrative networks via network segmentation or WAF allow-listing, and enable enhanced auditing of privileged Billing transactions to detect abuse - trade-offs are added administrative overhead and potential disruption to legitimate finance operators who legitimately need those roles. Do not rely on network controls alone since the attacker already requires elevated application privileges.