Oracle PeopleSoft CVE-2026-61236

Exploitation requires that a vulnerable Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 instance (Staffing component) be network-reachable over HTTP from the attacker - typically a PeopleSoft Internet Architecture web tier. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no elevated privileges, and no user interaction are needed against the affected module. The primary limiting factor is deployment scope: only environments running the Brazil financial localization package at version 9.1 are affected, so organizations not using the Brazil-locale Staffing module are not exposed, and instances whose web tier is not reachable from the attacker's network are protected by that isolation.

The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case exposure conditions: network reachable, low complexity, no privileges, no user interaction - meaning any actor who can reach the PeopleSoft web tier can attempt exploitation. The 7.5 score is driven entirely by C:H, with I:N and A:N, so this is a data-exposure issue, not a code-execution or service-disruption one. No EPSS score was provided in the input, so exploitation probability cannot be quantified here, and there is no KEV listing or public POC, which lowers the near-term likelihood of opportunistic mass exploitation. That said, 'easily exploitable' per Oracle plus unauthenticated network reach makes this a credible target once details or scanners emerge; treat it as a real patching priority for any Brazil-localized PeopleSoft Financials deployment, while recognizing the narrow module scope limits the population of exposed instances.

An attacker who can reach the PeopleSoft web front end sends a crafted, unauthenticated HTTP request to the vulnerable FIN Common Objects Brazil / Staffing endpoint and receives back financial or staffing data it should not be able to see. Because no login, user interaction, or special client is required (AC:L/PR:N/UI:N), the request can be scripted and repeated to harvest large volumes of accessible data. No public exploit is identified at time of analysis, so an attacker would first need to derive the vulnerable request pattern.