Oracle PeopleSoft CVE-2026-61232

Exploitation requires network access to the PeopleSoft Internet Architecture web/application tier serving the FIN Common Objects Brazil (Common Objects) functionality over HTTP; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, credentials, or user interaction is needed against the affected 9.1 module. The main limiting factors are deployment-specific: the target organization must actually run the PeopleSoft Enterprise FIN Common Objects Brazil localization at version 9.1, and the attacker must be able to route HTTP to the PIA endpoint - which in many environments is internal, VPN-gated, or proxy-fronted rather than internet-exposed, materially narrowing the realistic attack surface.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 High) is internally consistent: network-reachable over HTTP, low complexity, no privileges, no user interaction, with full confidentiality loss but no integrity or availability impact. Oracle explicitly describes it as 'easily exploitable,' which reinforces the AC:L/PR:N assessment. However, the practical risk is bounded by exposure: PeopleSoft PIA front-ends are frequently placed behind VPNs, reverse proxies, or internal networks rather than the open internet, so 'network access' does not necessarily mean internet-wide. No EPSS score, SSVC decision, KEV entry, or POC was supplied in the intelligence, so exploitation probability cannot be quantified - treat the 'no public exploit identified' status as absence of evidence, not evidence of safety. This is a genuine priority for organizations running Brazilian PeopleSoft Financials localization (data-theft risk with no auth barrier), but a lower priority where the specific Brazil FIN module is not deployed or the PIA tier is not externally reachable.

An attacker who can reach the PeopleSoft PIA web tier sends crafted HTTP requests directly to the FIN Common Objects Brazil functionality and, because no authentication is enforced on the vulnerable path, retrieves sensitive financial data without valid credentials. Given AC:L/PR:N/UI:N, no special timing, tokens, or victim interaction is required. No public POC has been identified at time of analysis, so this scenario is inferred from the CVSS vector and Oracle's 'easily exploitable' characterization.