EUVD-2026-47280
GHSA-79x9-3q7g-mwpr
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
Network HTTP vector confirmed; low privilege matches authenticated ERP user; AC:H reflects difficult exploitation; no confidentiality impact per description; partial DoS maps to A:L.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise FIN General Ledger Argentina product of Oracle PeopleSoft (component: General Ledger). The supported version that is affected is 9.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN General Ledger Argentina. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN General Ledger Argentina accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN General Ledger Argentina. CVSS 3.1 Base Score 5.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L).
AnalysisAI
Integrity compromise and partial denial-of-service in Oracle PeopleSoft Enterprise FIN General Ledger Argentina 9.1 allows a low-privileged, network-based attacker to create, delete, or modify critical financial data and partially disrupt service availability via HTTP. Exploitation is rated difficult (AC:H), and no confidentiality impact is indicated, suggesting the flaw is scoped to data-write and availability disruption within the Argentina General Ledger component. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
Oracle PeopleSoft Enterprise is a large-scale ERP platform widely used in enterprise finance operations. The affected component is the Argentina localization of the FIN General Ledger module (version 9.1), accessible over HTTP. The vulnerability resides in a network-exposed endpoint that can be reached by authenticated low-privilege users. No CWE is assigned in the available data, so the precise root cause class - whether improper authorization, input validation failure, or state management - cannot be confirmed from current intelligence. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U) indicates that while the attack path is network-based and requires no user interaction, conditions for successful exploitation are non-trivial, implying a race condition, specific application state, or multi-step exploitation sequence may be involved.
RemediationAI
Apply the Oracle Critical Patch Update (CPU) for July 2026, which addresses this vulnerability for PeopleSoft Enterprise FIN General Ledger Argentina 9.1. The exact patched version should be confirmed by reviewing the Oracle CPU release notes at https://www.oracle.com/security-alerts/cpujul2026.html, as the specific fix version is not independently confirmed from available data. As a compensating control where patching is not immediately possible, restrict HTTP access to the General Ledger Argentina component to only those users and network segments with a business need, and audit low-privileged accounts with access to the Argentina GL module. Reducing the pool of users who can reach this endpoint directly constrains the attack surface given the PR:L requirement. Note that access restriction does not eliminate the flaw, only reduces the attacker population.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today