What is the CVSS score of CVE-2026-61238?

CVE-2026-61238 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-61238?

Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement module) contains a critical unauthenticated remote vulnerability enabling attackers to read, create, delete, and modify all…

How to fix or mitigate CVE-2026-61238?

Within 24 hours, identify and isolate all systems running Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1, restricting network access to the eProcurement module to essential personnel only pending patch deployment. Within 7 days, apply the Oracle Critical Patch Update of July 2026 to all affected production and non-production instances, with testing completed in staging environments before production rollout. Within 30 days, conduct a forensic audit of system access logs for the prior 30 days to identify potential unauthorized data access, confirm patch deployment across all instances, and implement network segmentation to limit eProcurement module access to authorized business users and systems only.

Oracle PeopleSoft CVE-2026-61238

EUVD-2026-47430 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4pf2-p694-fvc4

Authentication Bypass Oracle Peoplesoft Enterprise Fin Common Objects

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Remote unauthenticated HTTP access with low complexity (AV:N/AC:L/PR:N/UI:N) enabling full read and modification of module data (C:H/I:H); no availability impact and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:05 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Argentina. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Common Objects Argentina accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Argentina accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. The CVSS 3.1 base score is 9.1 (C:H/I:H, no availability impact) and the flaw is described by Oracle as easily exploitable, with an "Authentication Bypass" tag reinforcing the PR:N vector. No public exploit is identified at time of analysis and it is not listed in CISA KEV; a fix ships in the Oracle Critical Patch Update of July 2026.

Technical ContextAI

The affected software is Oracle PeopleSoft, an enterprise ERP/HCM/Financials platform, specifically the FIN Common Objects Argentina localization module served through the eProcurement component. PeopleSoft applications are delivered over HTTP via PeopleSoft Internet Architecture (PIA) web servlets, so a network-reachable HTTP endpoint is the exposed surface. Oracle does not assign a CWE (CWE: N/A), but the vendor 'Authentication Bypass' tag combined with the CVSS PR:N metric points to a root cause in the authorization/authentication enforcement path - a request handler that fails to require or correctly validate a session before granting access to sensitive eProcurement data operations. Because scope is unchanged (S:U), impact is confined to the data and privileges of the vulnerable PeopleSoft component itself rather than the underlying host.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html) - Oracle does not publish a discrete point-release version number for this component, so identify the specific PeopleSoft PeopleTools/PUM patch mapped to CVE-2026-61238 within that CPU and apply it. Oracle strongly recommends applying CPU patches without delay for unauthenticated network-exploitable issues. Until patching is complete, reduce exposure by restricting network reachability of the PeopleSoft Internet Architecture endpoints for the eProcurement/FIN Common Objects Argentina module to trusted internal networks or via VPN, and place the PIA web tier behind a WAF or reverse proxy that enforces authenticated sessions on the affected servlet paths; the trade-off is that overly broad access restrictions may block legitimate remote procurement users, so scope the controls to the affected module rather than the whole PeopleSoft footprint. Monitor web/application logs for anomalous unauthenticated requests to eProcurement endpoints as a detective control.