Oracle PeopleSoft CVE-2026-61074

Exploitation targets the eProcurement component of the PeopleSoft Enterprise FIN Common Objects Brazil 9.1 module and requires HTTP network reachability to the PeopleSoft Internet Architecture web tier; no authentication is required (PR:N) and no user interaction is needed (UI:N). The primary limiting factor is high attack complexity (AC:H) - Oracle states the vulnerability is 'difficult to exploit,' implying the attacker must satisfy conditions outside their direct control (such as specific timing, configuration, or environmental state) rather than firing a single trivial request. A further practical limiter is deployment scope: only environments that have installed and exposed the Brazil-specific financial localization module with the eProcurement component are affected, so organizations without the Brazil localization are not vulnerable.

The CVSS 3.1 base score is 8.1 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - network-reachable and unauthenticated (PR:N) with full confidentiality, integrity, and availability impact, but gated by high attack complexity (AC:H), which materially lowers real-world exploitability. No EPSS score, SSVC decision, or KEV listing was provided, and no public proof-of-concept was identified, so there is no current signal of active or automatable exploitation. The combination of no-authentication plus full-takeover impact makes this a serious patch priority for any organization running the Brazil localization module, but the high complexity and absence of exploitation signals suggest it is not an emergency drop-everything issue relative to lower-complexity unauthenticated bugs. Note a mild tension: Oracle's 'Information Disclosure' tag emphasizes read access, while the CVSS vector and 'takeover' language indicate full write/availability impact - treat the higher impact reading as authoritative and verify specifics against Oracle's advisory.

A remote attacker with no credentials sends specially crafted HTTP requests to the internet-facing eProcurement endpoints of a PeopleSoft FIN Common Objects Brazil 9.1 deployment, chaining the conditions needed to satisfy the high-complexity flaw, and gains the ability to read and manipulate financial data, ultimately taking over the component. Exploitation is non-trivial due to the AC:H rating and no public proof-of-concept is known at this time.