What is the CVSS score of CVE-2026-61234?

CVE-2026-61234 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-61234?

Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (eProcurement) contains a remote authentication bypass allowing unauthorized read, create, modify, and delete operations on all data within…

How to fix or mitigate CVE-2026-61234?

Within 24 hours, identify and inventory all systems running Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1; document scope of accessible financial and procurement data; implement HTTP-level access restrictions or firewall rules to limit module exposure if operationally feasible. Within 7 days, obtain the Oracle July 2026 Critical Patch Update and validate compatibility in a non-production environment. Within 30 days, deploy the patch to all affected production systems and confirm remediation through vulnerability rescanning and access testing.

Oracle PeopleSoft CVE-2026-61234

EUVD-2026-47426 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-r5vx-xgm6-3m2r

Authentication Bypass Oracle Peoplesoft Enterprise Fin Common Objects

7.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Unauthenticated HTTP-reachable endpoint (AV:N/PR:N/UI:N) with high data read and modification impact (C:H/I:H) but no availability effect; vendor-stated difficulty gives AC:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:07 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.4

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Brazil. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Common Objects Brazil accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Brazil accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (eProcurement component) lets a remote unauthenticated attacker read, create, modify, or delete all data accessible to the module over HTTP. The flaw is rated CVSS 3.1 7.4 with high confidentiality and integrity impact but no availability impact, and is difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor advisory ties the fix to the Oracle July 2026 Critical Patch Update.

Technical ContextAI

PeopleSoft is Oracle's enterprise ERP suite; the affected element is the FIN (Financials) Common Objects Brazil localization pack, specifically its eProcurement component handling supplier and purchasing workflows exposed through the PeopleSoft Internet Architecture (PIA) web tier. The attack surface is an HTTP-facing servlet/endpoint reachable without a session, consistent with the AV:N/PR:N vector. Oracle assigns no CWE (CWE: N/A); the reporter tag 'Authentication Bypass' together with the unauthenticated-yet-high-impact profile points to an access-control or authorization weakness (CWE-284/CWE-863 class) rather than memory corruption, but the exact root cause is not confirmed in the provided data.

RemediationAI

Apply the fix delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory - no discrete fix version number is published in the input beyond the CPU); consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch set and PeopleTools bundle applicable to FIN Common Objects Brazil 9.1. Until the CPU is applied, reduce exposure by removing the PeopleSoft Internet Architecture web tier and the eProcurement endpoints from direct internet reachability, placing them behind a VPN or WAF and restricting access to trusted networks; note this can break external supplier self-service access to eProcurement, so validate business impact before enforcing. Because the flaw is unauthenticated, network-layer access restriction is the most reliable compensating control while patching is scheduled.