Oracle PeopleSoft CVE-2026-61238

No special conditions - remote unauthenticated exploitation over HTTP against Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component); the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low attack complexity. What LIMITS exploitation is deployment scope rather than technical prerequisites: the target must be a PeopleSoft installation running the Argentine financials localization at version 9.1 with the eProcurement/FIN Common Objects Argentina web endpoint network-reachable to the attacker. Organizations that do not deploy this specific Argentina localization module, or that restrict the PIA endpoints to internal networks/VPN, are not realistically exposed despite the high CVSS.

Signals are largely consistent and point to a genuine high priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N yields a 9.1 base score, meaning remote, low-complexity, unauthenticated exploitation with no user interaction, and Oracle explicitly labels it 'easily exploitable.' High confidentiality and integrity impact (C:H/I:H) with no availability impact (A:N) is typical of a data-exposure/manipulation bug rather than a crash or RCE. Countervailing factors temper urgency: there is no CISA KEV listing (no confirmed active exploitation), no public POC identified, no EPSS score provided in the input, and no SSVC decision data supplied - so probability-of-exploitation and automatability cannot be quantified from the available data. The mitigating real-world factor is footprint: this is the Argentina financial localization module of PeopleSoft, so only organizations that deploy PeopleSoft Financials with the Argentine localization at version 9.1 are exposed. Net: treat as high-priority patching for affected deployments given the trivial exploitability and total data compromise, while recognizing exploitation-in-the-wild is unproven.

An attacker who can reach the PeopleSoft eProcurement HTTP endpoint sends crafted requests that bypass authentication, then reads or tampers with financial procurement data (vendors, orders, critical records) belonging to the FIN Common Objects Argentina module. Because no authentication, user interaction, or special conditions are required and complexity is low, the attack can be scripted and repeated; no public POC has been identified at time of analysis, so exploitation would require independent development.