Oracle PeopleSoft CVE-2026-61237

The affected component must be reachable over HTTP: an exposed PeopleSoft Internet Architecture / Integration Broker endpoint for the FIN Common Objects Argentina module in a version-9.1 Financials deployment that has the Argentine localization installed. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required and attack complexity is low, so exploitation works against reachable default-configured instances. Limiting factors are deployment-specific rather than configuration-flag-specific: the vulnerable module is an Argentina financial localization, so only PeopleSoft Financials environments that deploy that localization are affected, and organizations that keep the PIA/Integration Broker off the public internet materially reduce exposure.

Signals largely align toward genuine priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L, base 9.9) describes low-complexity, unauthenticated, no-interaction network exploitation with high confidentiality impact and cross-scope reach - the highest-risk profile short of full RCE. Oracle explicitly labels it 'easily exploitable,' reinforcing low attack complexity. Counterbalancing this, no EPSS score, SSVC decision, POC, or KEV status was provided, so real-world exploitation is not demonstrated and there is no evidence of active or automatable exploitation yet. The vendor tags 'Denial Of Service' and 'Authentication Bypass' are generic Oracle CPU categorizations and should not be over-read: the CVSS integrity/availability impacts are only Low (I:L/A:L), so 'complete access to all data' applies to confidentiality (C:H) while write and DoS effects are partial. Net: treat as high priority because of the unauthenticated network vector and scope change, but note that no exploitation-in-the-wild or POC signal is currently available to confirm imminent mass exploitation.

An attacker who can reach the PeopleSoft PIA/Integration Broker over HTTP sends a crafted request to the vulnerable Integration endpoint of the FIN Common Objects Argentina module without any credentials or user interaction. Successful exploitation returns sensitive PeopleSoft data, permits limited unauthorized data modification, and can partially disrupt service; the scope change means impact can extend to connected PeopleSoft products. No public exploit is identified at time of analysis, so this scenario is inferred from the CVSS vector rather than an observed POC.