Oracle PeopleSoft CVE-2026-61239

The vulnerable code is the eProcurement component of PeopleSoft Enterprise FIN Common Objects Argentina 9.1, so the deployment must run this Argentina financials localization with its PeopleSoft Internet Architecture web tier reachable over HTTP by the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required and complexity is low, so no special conditions beyond network reachability apply against affected deployments of this module. The primary limiting factors are deployment-specific: an organization must actually license and run the Argentina localization (a regional module, not universal), and the affected endpoints must be network-accessible to the attacker - internet exposure of the PIA tier greatly raises real risk while internal-only exposure reduces it.

The signals are mixed between raw severity and real-world urgency. The CVSS 3.1 score is 9.9 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L - remote, low-complexity, unauthenticated, no user interaction, with a scope change that inflates the score; note the underlying impacts are actually C:L/I:H/A:L, so the headline 9.9 is driven largely by the scope change plus high integrity impact rather than uniformly total CIA loss. No EPSS score, no KEV listing, and no POC were provided, so probability-of-exploitation and confirmed active exploitation are unknown/absent. This makes the flaw a genuine patching priority for any organization actually running the Argentina localization, but the absence of KEV/EPSS/POC indicates no evidence of widespread exploitation yet - treat as high-priority-to-patch rather than a confirmed emergency. One caveat: Oracle CPU descriptions are terse and the CVSS is vendor-assigned, so the exact prerequisites and whether the module is internet-exposed in a given deployment should be verified against the environment.

An attacker who can reach the PeopleSoft PIA web tier sends crafted HTTP requests to the eProcurement/FIN Common Objects Argentina endpoints without any credentials or user interaction, given the low attack complexity. They then create, delete, or modify critical financial procurement data and, via the scope change, pivot to affect additional PeopleSoft data or products, and can also degrade availability (partial DoS). No public proof-of-concept has been identified, so exploitation would currently require original research against the module.