EUVD-2026-47407
GHSA-vfq4-2q5r-3ggf
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Remote unauthenticated compromise of Oracle PeopleSoft Enterprise FIN Expenses 9.2 (Expenses component) allows attackers with only HTTP network access to read, create, delete or modify all Expenses-accessible data and to cause a partial denial of service. Rated CVSS 3.1 9.4 and flagged by Oracle as easily exploitable, meaning no authentication or user interaction is required. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low-complexity unauthenticated profile makes it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Peoplesoft Enterprise Fin Expenses gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise FIN Expenses product of Oracle PeopleSoft (component: Expenses). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Expenses. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Expenses accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Expenses accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Expenses. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L).
Executive ViewAI
Critical remote unauthenticated vulnerability (CVE-2026-61203) in Oracle PeopleSoft Enterprise FIN Expenses 9.2 enables attackers to read, create, delete, and modify all expense data with no credentials required, directly threatening financial data integrity and compliance. No vendor patch is currently available, requiring immediate emergency containment to protect core financial systems. Organizations running this version must assume data compromise risk is active and deploy interim security controls today.
Within 24 hours, inventory all systems running PeopleSoft FIN Expenses 9.2, immediately segment network access to restrict HTTP connections to this component to trusted administrative networks only, and enable real-time monitoring of Expenses data access and modifications. Within 7 days, deploy Web Application Firewall (WAF) rules to block malicious HTTP requests targeting the Expenses component, review access logs for signs of unauthorized access or data changes, and establish daily alerting on all administrative operations to the system. Within 30 days, obtain specific patch timeline from Oracle, evaluate upgrading to a patched PeopleSoft version if available, conduct forensic audit of Expenses data for unauthorized modifications, and communicate remediation timeline to finance leadership and compliance/audit functions.
No vendor-released patch identified at time of analysis. Implement these interim controls: restrict network access to PeopleSoft FIN Expenses 9.2 via firewall rules to trusted administrative IPs only; deploy Web Application Firewall (WAF) rules to inspect HTTP traffic for exploit payloads; enable comprehensive access logging with real-time alerts on Expenses data reads and modifications; restrict database-level write permissions to administrators only; perform daily Expenses data integrity audits; and monitor Oracle security advisories and CISA KEV for patch availability with immediate deployment upon release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB