Oracle PeopleSoft CVE-2026-61234

Exploitation requires network HTTP access to the PeopleSoft Internet Architecture web tier hosting the eProcurement component of FIN Common Objects Brazil 9.1; no authentication and no user interaction are needed (PR:N/UI:N). The key limiting factor is High attack complexity (AC:H): Oracle labels it 'difficult to exploit,' indicating a condition outside the attacker's direct control (specific configuration, state, or timing) must hold. Exploitation is further limited to deployments that actually run the Brazil localization pack version 9.1 and expose eProcurement, and impact is confined to confidentiality and integrity of module-accessible data (A:N - no availability or denial-of-service effect).

Signals point to elevated-but-not-emergency priority. The CVSS 7.4 is driven by high C and I impact with unauthenticated network reach (AV:N/PR:N/UI:N), which normally indicates high priority, but High attack complexity (AC:H) materially lowers exploitability - Oracle explicitly calls it 'difficult to exploit,' implying a special condition or timing the attacker cannot fully control. No EPSS score, KEV entry, POC, or SSVC decision data is supplied, so automatability and in-the-wild exploitation cannot be assessed and must not be assumed. The 'Authentication Bypass' tag partially conflicts with a purely data-access description - verify the true impact scope with Oracle. Net: a real patch-worthy issue for internet-exposed PeopleSoft financials, but AC:H plus the absence of any exploitation evidence argue against treating it as an active-exploitation crisis.

An attacker who can reach the PeopleSoft PIA web tier over HTTP sends a specially crafted request to the eProcurement component and, without any credentials, retrieves or alters financial and procurement records in the Brazil Common Objects module. The High attack complexity means the attacker likely must satisfy a non-trivial precondition or race, and no public POC is currently identified, so opportunistic mass exploitation is less likely than targeted attempts.