What is the CVSS score of CVE-2026-61074?

CVE-2026-61074 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-61074?

Oracle PeopleSoft Enterprise FIN module version 9.1 contains a remote unauthenticated vulnerability in the eProcurement component that enables complete system compromise, affecting organizations that…

How to fix or mitigate CVE-2026-61074?

Within 24 hours: Identify all instances of Oracle PeopleSoft 9.1 FIN with active eProcurement components and categorize by business criticality. Within 7 days: Restrict network access to FIN eProcurement systems to internal/VPN-only connections, implement Web Application Firewall rules targeting exploitation patterns, enable detailed audit logging of all eProcurement transactions and user activities, and configure automated alerts for suspicious access or high-value transactions. Within 30 days: Monitor Oracle's official advisories for patch availability for CVE-2026-61074, establish an expedited patch testing and deployment process for when the patch is released, and document all compensating controls for audit compliance.

Oracle PeopleSoft CVE-2026-61074

EUVD-2026-47285 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-mhf9-rxvp-f8wq

Authentication Bypass Oracle Peoplesoft Enterprise Fin Common Objects

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated HTTP-reachable eProcurement endpoint gives AV:N/PR:N/UI:N; Oracle's 'difficult to exploit' justifies AC:H; component takeover yields full C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:58 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Brazil. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Common Objects Brazil. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of the Oracle PeopleSoft Enterprise FIN Common Objects Brazil module (version 9.1, eProcurement component) is possible by a remote unauthenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation results in complete takeover of the affected component, though Oracle rates the attack as difficult to execute (high attack complexity). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected software is Oracle PeopleSoft, a widely used enterprise resource planning (ERP) suite, specifically the FIN Common Objects Brazil localization package that supports Brazilian financial/tax requirements within the Financials product line. The vulnerable code path sits in the eProcurement component, which handles web-facing procurement workflows served over HTTP through the PeopleSoft Internet Architecture (PIA) application tier. No CWE was assigned in the source data, so the precise root-cause class (e.g., injection, deserialization, or authentication bypass) cannot be confirmed; the Oracle tag 'Information Disclosure' plus full C/I/A impact suggests a flaw allowing an attacker to read and manipulate application data leading to component takeover, but the exact mechanism is not documented in the available intelligence.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); the source data does not name an exact patched build number, so treat this as 'patch available per vendor advisory' and consult the CPU matrix for the specific PeopleSoft PeopleTools/patch level applicable to version 9.1. Until patching, reduce exposure by restricting network access to the PeopleSoft Internet Architecture web tier - place the application behind a VPN or IP allow-list and block untrusted internet access to the eProcurement URLs - and consider disabling or restricting the eProcurement self-service module if it is not required in the Brazil deployment; the trade-off is that these controls will block legitimate remote procurement users and self-service access. Review web/application server logs for anomalous requests to eProcurement endpoints as a detective control.