What is the CVSS score of CVE-2026-61236?

CVE-2026-61236 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-61236?

Oracle PeopleSoft Enterprise FIN 9.1 (Brazil/Staffing) contains an unauthenticated information disclosure vulnerability (CVE-2026-61236) that permits remote attackers to read sensitive financial data…

How to fix or mitigate CVE-2026-61236?

Within 24 hours: Identify and inventory all PeopleSoft FIN 9.1 instances running the Brazil Staffing component; restrict network access to these systems to internal IP ranges only; enable detailed HTTP request logging on affected servers. Within 7 days: Deploy Web Application Firewall rules to enforce authentication requirements on the Staffing component endpoints; require VPN access for all remote connections to PeopleSoft FIN; audit access logs for signs of unauthorized data access. Within 30 days: Contact Oracle Support for an emergency security advisory and patched version availability (target PeopleSoft FIN 9.2 or later); evaluate timeline for upgrading affected instances; perform comprehensive vulnerability assessment across other legacy PeopleSoft modules to identify similar exposures.

Oracle PeopleSoft CVE-2026-61236

EUVD-2026-47428 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-w4p2-534r-vq86

Authentication Bypass Oracle Peoplesoft Enterprise Fin Common Objects

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated HTTP-reachable data exposure gives AV:N/AC:L/PR:N/UI:N; impact is confidentiality-only (C:H, I:N, A:N) with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:06 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Staffing). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Brazil. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Brazil accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthenticated information disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Staffing component) lets a remote attacker send crafted HTTP requests to read critical data, potentially achieving complete access to all data accessible to the affected module. Oracle rates it easily exploitable with a CVSS 3.1 base score of 7.5, but the impact is confined to confidentiality (no integrity or availability effect). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected software is Oracle's PeopleSoft Enterprise Financials suite, specifically the FIN Common Objects Brazil localization package and its Staffing component, a web-facing enterprise ERP application typically deployed on PeopleSoft PIA (PeopleSoft Internet Architecture) with WebLogic/Tomcat front ends and a Tuxedo application tier. The vulnerability is reached over HTTP without authentication, indicating a flaw in a web-exposed servlet, iScript, or component-interface endpoint that fails to enforce access control on data retrieval. Oracle did not assign a CWE (listed as N/A), but the vendor's own tagging as 'Authentication Bypass' together with the confidentiality-only CVSS impact points to a missing-authorization / improper access control root cause (CWE-284/CWE-306 class) that exposes back-end financial data.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); the input does not include an exact patch/bundle number, so this is Patch available per vendor advisory - obtain the specific PeopleSoft PUM image / CPU patch for FIN Common Objects Brazil 9.1 from My Oracle Support and schedule it in your next maintenance window. Until patched, restrict network exposure of the PeopleSoft Internet Architecture web tier: place PIA behind a VPN or internal-only network segment, and use a WAF or reverse-proxy rule to restrict or block access to the vulnerable Staffing/Brazil-localization URLs and iScripts for untrusted sources (trade-off: may disrupt legitimate Brazil-locale users or integrations, so validate URL patterns before enforcing). Increase monitoring of PIA access logs for anomalous unauthenticated requests to the affected component. Do not rely on workarounds as a permanent fix, since the underlying access-control flaw remains until the CPU patch is applied.