What is the CVSS score of CVE-2026-61233?

CVE-2026-61233 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-61233?

Oracle PeopleSoft Enterprise Financials Brazil 9.1 is vulnerable to unauthenticated remote code execution (CVSS 9.8) enabling complete takeover of the financial integration module, directly…

How to fix or mitigate CVE-2026-61233?

Within 24 hours: Identify all systems running Oracle PeopleSoft Enterprise FIN 9.1 with Brazil localization, assess internet or untrusted-network exposure of integration modules, and implement network segmentation to restrict HTTP access to affected components. Within 7 days: Deploy intrusion detection and prevention signatures targeting unauthenticated access to PeopleSoft Financials integration endpoints; enable comprehensive audit logging of access attempts and system changes; restrict administrative access and enforce multi-factor authentication on all module accounts. Within 30 days: Coordinate with Oracle support to confirm patch timeline and availability; prepare contingency plans for system isolation or offline operation of integration modules; evaluate alternative financial management systems as risk mitigation strategy.

Oracle PeopleSoft CVE-2026-61233

EUVD-2026-47425 CRITICAL

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-wrq9-xvch-r7w8

Information Disclosure Oracle Peoplesoft Enterprise Fin Common Objects

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor describes unauthenticated HTTP-reachable takeover with low complexity, so AV:N/AC:L/PR:N/UI:N; full module compromise gives C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:08 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Integration). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Brazil. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Common Objects Brazil. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Integration component) is possible by an unauthenticated remote attacker over HTTP, with Oracle rating the flaw CVSS 9.8 and describing 'takeover' of the affected module. Disclosed in Oracle's July 2026 Critical Patch Update (CPUJUL2026), the issue affects the Brazilian financial-localization objects of the PeopleSoft Financials suite. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected software is Oracle PeopleSoft, a large enterprise ERP/HCM/Financials platform, specifically the FIN Common Objects Brazil localization pack used to support Brazilian tax, fiscal and accounting requirements within PeopleSoft Financials. The vulnerable subcomponent is 'Integration', which in PeopleSoft typically covers the Integration Broker and web-facing service/messaging endpoints that accept HTTP traffic. Oracle did not assign a CWE (CWE: N/A) and, following its usual CPU disclosure practice, withholds root-cause detail; the combination of an HTTP-reachable Integration surface plus full confidentiality, integrity and availability impact is consistent with an injection, authentication-bypass or deserialization-class flaw, but the exact weakness class cannot be confirmed from the available data.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (CPUJUL2026) as documented at https://www.oracle.com/security-alerts/cpujul2026.html; consult that advisory for the exact patch bundle and any prerequisite maintenance level for PeopleSoft FIN Common Objects Brazil 9.1, as no discrete fix version string was included in the input (Patch available per vendor advisory - exact patched version not independently confirmed here). Because the attack is unauthenticated and HTTP-based against the Integration surface, apply compensating controls until patched: restrict network access to the PeopleSoft Integration Broker / web endpoints to trusted internal hosts and VPN via firewall or reverse-proxy allow-listing (side effect: may break legitimate external partner integrations), place the affected gateway behind a WAF tuned for PeopleSoft, and disable or lock down any unused Integration Broker web services and gateway endpoints (side effect: could interrupt EIP messaging flows that rely on them). Validate all changes in a non-production environment first, as PeopleSoft integration changes can disrupt financial batch and messaging processes.