What is the CVSS score of CVE-2026-61204?

CVE-2026-61204 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of PeopleSoft FIN Management are affected by CVE-2026-61204?

Oracle PeopleSoft Enterprise FIN Program Management 9.2 (Primavera Integration) contains a critical account takeover vulnerability enabling low-privilege authenticated users to achieve complete…

How to fix or mitigate CVE-2026-61204?

Within 24 hours: Restrict access to PeopleSoft 9.2 Primavera Integration component to essential personnel only and audit all active user accounts for risky privilege levels; enable comprehensive logging on module access and data changes. Within 7 days: Implement mandatory multi-factor authentication for all access to the affected component, conduct user awareness briefing on credential compromise and phishing tactics, and map all downstream Oracle products integrated with Primavera to assess contamination risk. Within 30 days: Monitor daily Oracle Critical Patch Update advisories for CVE-2026-61204 remediation; execute pre-deployment testing on a non-production PeopleSoft 9.2 instance; plan and execute patch deployment once available; perform full access re-certification and enforce least-privilege role assignment.

PeopleSoft FIN Management CVE-2026-61204

EUVD-2026-47408 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-rxpw-r49h-389r

Privilege Escalation Oracle Peoplesoft Enterprise Fin Program Management

9.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Remote HTTP with low privilege and required victim interaction; scope change into integrated products with full CIA takeover justifies S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:13 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.0

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Program Management product of Oracle PeopleSoft (component: Primavera Integration). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Program Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise FIN Program Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Program Management. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle PeopleSoft Enterprise FIN Program Management 9.2 (Primavera Integration component) lets a low-privileged, authenticated remote attacker fully compromise the module by luring a separate legitimate user into interacting with malicious HTTP content, with a scope change that spills the impact into other integrated Oracle products. Oracle rates it CVSS 3.1 9.0 with full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis; it is disclosed only via the Oracle July 2026 Critical Patch Update.

Technical ContextAI

PeopleSoft Enterprise FIN Program Management is part of Oracle's PeopleSoft Financials/ERP suite, and the affected surface is the Primavera Integration component that bridges PeopleSoft financials with Oracle Primavera project-portfolio management over HTTP. The CVSS profile (AV:N/AC:L/PR:L/UI:R/S:C) combined with required user interaction and a scope change is characteristic of a web-tier flaw - such as cross-site scripting, request forgery, or an injection/HTML-rendering issue in the integration UI - that executes in a victim's authenticated session and pivots into linked systems. Oracle assigned no CWE (listed N/A), so the precise weakness class cannot be confirmed from the provided data; the Oracle-supplied 'Information Disclosure' tag aligns with the C:H rating but does not by itself explain the full I:H/A:H takeover impact.

RemediationAI

Apply the fix delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle CPUs ship the patched PeopleSoft bundle for version 9.2, but no discrete fixed build number is stated in the input, so treat the July 2026 CPU as the vendor-released patch and confirm the exact patch ID in My Oracle Support. Until the CPU is applied, reduce exposure by restricting network access to the Primavera Integration endpoints to trusted internal hosts, tightening PeopleSoft role permissions so fewer low-privileged accounts can reach the component, and instructing users not to follow untrusted links into the application (the flaw requires victim interaction); if the Primavera Integration feature is not actively used, disabling that integration removes the attack surface at the cost of losing PeopleSoft-to-Primavera project data exchange. These are compensating controls only and do not replace the CPU patch.