What is the CVSS score of CVE-2026-61233?

CVE-2026-61233 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate CVE-2026-61233?

Within 24 hours: Identify all systems running Oracle PeopleSoft Enterprise FIN 9.1 with Brazil localization, assess internet or untrusted-network exposure of integration modules, and implement network segmentation to restrict HTTP access to affected components. Within 7 days: Deploy intrusion detection and prevention signatures targeting unauthenticated access to PeopleSoft Financials integration endpoints; enable comprehensive audit logging of access attempts and system changes; restrict administrative access and enforce multi-factor authentication on all module accounts. Within 30 days: Coordinate with Oracle support to confirm patch timeline and availability; prepare contingency plans for system isolation or offline operation of integration modules; evaluate alternative financial management systems as risk mitigation strategy.

Oracle PeopleSoft CVE-2026-61233

EUVD-2026-47425 CRITICAL

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-wrq9-xvch-r7w8

Information Disclosure Oracle Peoplesoft Enterprise Fin Common Objects

9.8

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach PeopleSoft HTTP Integration endpoint
Delivery

Send crafted unauthenticated request
Exploit

Exploit Integration component flaw
Execution

Gain control of module
Impact

Read/alter financial data and disrupt availability

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The affected PeopleSoft Integration endpoint (Integration Broker / web gateway) for the FIN Common Objects Brazil 9.1 module must be network-reachable by the attacker over HTTP; per CVSS PR:N/UI:N no credentials and no user interaction are required against that reachable endpoint. The primary limiting factor is exposure: PeopleSoft Integration surfaces are frequently confined to internal networks or partner links, so an internet-exposed gateway is the main enabler, while instances reachable only from trusted internal segments substantially reduce realistic risk. Exploitation is further scoped to the Brazil financial-localization component of PeopleSoft Financials at supported version 9.1 - environments without this localization pack deployed are not in scope.
Impact	The signals that ARE available point to high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates a network-reachable, low-complexity, unauthenticated attack with full CIA impact, and Oracle explicitly calls it 'easily exploitable.' However, several corroborating signals are MISSING or CONFLICTING: no EPSS score, no SSVC decision, and no KEV entry were supplied, so exploitation probability cannot be quantified and there is no evidence of active exploitation. The supplied tag 'Information Disclosure' CONFLICTS with the vector's full integrity and availability impact and Oracle's 'takeover' language - treat the tag as an incomplete label rather than a scope limiter, and rely on the CVSS vector, which describes far more than disclosure. Net: the vulnerability warrants urgent patching on exposed PeopleSoft Financials instances, but the absence of EPSS/KEV/POC data means real-world exploitation is currently unproven, not disproven.
Exploit ScenarioDerived	An attacker who can reach the PeopleSoft web/Integration Broker endpoint over HTTP sends a single crafted, unauthenticated request to the vulnerable Integration handler and, given the low attack complexity, achieves takeover of the FIN Common Objects Brazil module - reading or altering financial data and disrupting availability. No public proof-of-concept exploit was identified at time of analysis, but the low-complexity, no-authentication profile means weaponization would be straightforward if technical details emerge.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Full compromise of Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Integration component) is possible by an unauthenticated remote attacker over HTTP, with Oracle rating the flaw CVSS 9.8 and describing 'takeover' of the affected module. Disclosed in Oracle's July 2026 Critical Patch Update (CPUJUL2026), the issue affects the Brazilian financial-localization objects of the PeopleSoft Financials suite. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (CPUJUL2026) as documented at https://www.oracle.com/security-alerts/cpujul2026.html; consult that advisory for the exact patch bundle and any prerequisite maintenance level for PeopleSoft FIN Common Objects Brazil 9.1, as no discrete fix version string was included in the input (Patch available per vendor advisory - exact patched version not independently confirmed here). Because the attack is unauthenticated and HTTP-based against the Integration surface, apply compensating controls until patched: restrict network access to the PeopleSoft Integration Broker / web endpoints to trusted internal hosts and VPN via firewall or reverse-proxy allow-listing (side effect: may break legitimate external partner integrations), place the affected gateway behind a WAF tuned for PeopleSoft, and disable or lock down any unused Integration Broker web services and gateway endpoints (side effect: could interrupt EIP messaging flows that rely on them). Validate all changes in a non-production environment first, as PeopleSoft integration changes can disrupt financial batch and messaging processes.

Affected VersionsENISA

PeopleSoft Enterprise FIN Common Objects Brazil 9.1

Affected Packages

euvd peoplesoft_enterprise_fin_common_objects_brazil no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected software is Oracle PeopleSoft, a large enterprise ERP/HCM/Financials platform, specifically the FIN Common Objects Brazil localization pack used to support Brazilian tax, fiscal and accounting requirements within PeopleSoft Financials. The vulnerable subcomponent is 'Integration', which in PeopleSoft typically covers the Integration Broker and web-facing service/messaging endpoints that accept HTTP traffic. Oracle did not assign a CWE (CWE: N/A) and, following its usual CPU disclosure practice, withholds root-cause detail; the combination of an HTTP-reachable Integration surface plus full confidentiality, integrity and availability impact is consistent with an injection, authentication-bypass or deserialization-class flaw, but the exact weakness class cannot be confirmed from the available data.

Know when Peoplesoft Enterprise Fin Common Objects gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Vendor describes unauthenticated HTTP-reachable takeover with low complexity, so AV:N/AC:L/PR:N/UI:N; full module compromise gives C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Integration). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Brazil. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Common Objects Brazil. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle PeopleSoft Enterprise Financials Brazil 9.1 is vulnerable to unauthenticated remote code execution (CVSS 9.8) enabling complete takeover of the financial integration module, directly threatening financial operations and data integrity for organizations with Brazilian business units. No vendor-released patch identified at time of analysis. This represents an immediate operational risk requiring urgent interim protective measures.

Business Impact: Severe

Compensating Controls

Implement network segmentation and firewall rules to restrict HTTP access to integration module endpoints from untrusted networks; deploy intrusion detection/prevention signatures targeting exploitation patterns; enable comprehensive audit logging of access and configuration changes; restrict administrative access with multi-factor authentication; consider offline or air-gapped operation of integration modules if operationally feasible; implement Web Application Firewall (WAF) rules targeting PeopleSoft Financials endpoints; maintain incident response procedures specific to financial system compromise.

Threat Intelligence Overview

EPSS Score

0.5%

Top 61% exploitable

Prevalence

Medium

Brazil financial-localization pack of widely-deployed PeopleSoft ERP, regionally scoped

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.