What is the CVSS score of CVE-2026-61239?

CVE-2026-61239 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-61239?

Oracle PeopleSoft Finance eProcurement module (version 9.1) is vulnerable to unauthenticated remote access attacks with no vendor patch currently available, creating immediate risk to purchase order…

How to fix or mitigate CVE-2026-61239?

Within 24 hours, audit all Oracle PeopleSoft Enterprise FIN instances with eProcurement enabled and restrict network access to the module to only authorized business users and administrator workstations via firewall rules. Within 7 days, implement network segmentation isolating the eProcurement module from the broader financial infrastructure, deploy Web Application Firewall rules blocking exploitation signatures, configure real-time alerting on module access and data modifications, and enable comprehensive audit logging for forensic review. Within 30 days, contact Oracle for patch availability and timeline for version 9.1, plan infrastructure upgrade to patched release, conduct 90-day historical log review for indicators of unauthorized access, and establish security monitoring baseline.

Oracle PeopleSoft CVE-2026-61239

EUVD-2026-47431 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9fg6-2757-5r9x

Authentication Bypass Denial Of Service Oracle Peoplesoft Enterprise Fin Common Objects

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

vuln.today AI

9.9 CRITICAL

Aligns with Oracle's vector: remote unauthenticated HTTP (AV:N/AC:L/PR:N/UI:N), scope change to other products (S:C), with high integrity and lower confidentiality/availability impact (C:L/I:H/A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:05 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Argentina. While the vulnerability is in PeopleSoft Enterprise FIN Common Objects Argentina, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Common Objects Argentina accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Common Objects Argentina accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Common Objects Argentina. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L).

AnalysisAI

Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker to reach the module over HTTP and achieve high-impact modification of critical data, limited data disclosure, and a partial denial of service. Because Oracle assigns a scope change (S:C), a successful attack can reach beyond the vulnerable module and significantly impact additional PeopleSoft products, which drives the 9.9 CVSS score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

PeopleSoft is Oracle's enterprise ERP suite; the affected code lives in the FIN Common Objects Argentina localization layer, which supplies shared financial objects consumed by the eProcurement (ePro) purchasing workflow. These modules run on the PeopleSoft Internet Architecture (PIA) web tier, so the exposed attack surface is an HTTP-facing application servlet. Oracle did not assign a CWE (CWE: N/A), so the precise root-cause class is unstated; the CVSS profile (network, low complexity, no privileges, no user interaction, scope change, high integrity impact) is consistent with a server-side injection or broken-access-control flaw that lets untrusted HTTP input act on shared financial objects, but the exact weakness cannot be confirmed from the available data.

RemediationAI

Apply the fix from the Oracle Critical Patch Update of July 2026: consult https://www.oracle.com/security-alerts/cpujul2026.html for the specific patch/bundle covering PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Patch available per vendor advisory; an exact fix build number was not included in the provided data, so pull the precise patch ID from the CPU matrix). Until the CPU patch is deployed, reduce exposure by ensuring the PeopleSoft Internet Architecture (PIA) web tier and the eProcurement endpoints are not reachable from the public internet - front them with a reverse proxy or WAF and restrict access to trusted corporate networks/VPN, and disable or restrict the Argentina localization functionality if it is not used in your deployment. These network-restriction controls can break legitimate remote or supplier access to eProcurement, so validate business impact before enforcing, and do not treat network restriction as a substitute for the Oracle patch.