What is the CVSS score of CVE-2026-61240?

CVE-2026-61240 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-61240?

Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 contains an authentication bypass allowing adjacent network attackers to access confidential financial data and perform unauthorized…

How to fix or mitigate CVE-2026-61240?

Within 24 hours: Inventory all PeopleSoft 9.1 FIN instances running the eSettlements component and map network connectivity to identify which systems sit on the same adjacent network segments; classify the sensitivity of data accessible through this component. Within 7 days: Implement network access controls restricting eSettlements component access to authenticated administrative systems only; enable audit logging for all data access; engage compliance and legal regarding notification obligations if financial data has been exposed. Within 30 days: Contact Oracle Support to confirm patch timeline and explore interim mitigations or compensating controls; begin planning upgrade to a patched version once released; conduct a comprehensive access review of PeopleSoft financial modules.

Oracle PeopleSoft CVE-2026-61240

EUVD-2026-47432 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-w38p-x4h6-xwc3

Authentication Bypass Information Disclosure Oracle Peoplesoft Enterprise Fin Common Objects

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Adjacent-segment access (AV:A) with no auth (PR:N) and low complexity; scope change (S:C) with full read (C:H), partial write (I:L), no availability impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:04 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: eSettlements). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise FIN Common Objects Argentina executes to compromise PeopleSoft Enterprise FIN Common Objects Argentina. While the vulnerability is in PeopleSoft Enterprise FIN Common Objects Argentina, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Argentina accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Common Objects Argentina accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).

AnalysisAI

Unauthorized data access in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eSettlements component) lets an unauthenticated attacker on the adjacent network segment read confidential PeopleSoft data and make limited unauthorized modifications. The flaw carries a scope change, so a successful attack can significantly impact products beyond the vulnerable module. No public exploit identified at time of analysis, and no EPSS or KEV signal is provided; the 8.2 CVSS score is driven by high confidentiality impact plus scope change rather than remote internet exploitability.

Technical ContextAI

The affected software is Oracle PeopleSoft, a large enterprise ERP suite; specifically the FIN Common Objects Argentina localization module and its eSettlements (electronic settlement/payment reconciliation) component in the Financials pillar. 'Common Objects' are shared framework elements reused across financial processes, which is consistent with the reported scope change - compromising a shared object can propagate impact to other PeopleSoft products that consume it. The CWE is not assigned (N/A) in the source data, but the vendor tag labels this an 'Authentication Bypass,' implying a class where access-control or session validation logic can be circumvented on the exposed communication segment. Because the CVSS vector specifies AV:A (Adjacent), exploitation is bound to the physical/logical network segment attached to the hardware running the module rather than routable internet access.

RemediationAI

Apply the fix delivered in Oracle's July 2026 Critical Patch Update; treat the CPU as the patch source (Patch available per vendor advisory - no discrete fix version string was provided in the input) and consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact bundle and PeopleTools/patch level applicable to your deployment. Do not invent a version number; confirm the precise patched release directly from the Oracle CPU matrix. Until patched, the most effective compensating control follows from the AV:A vector: restrict and segment the physical communication segment attached to the PeopleSoft hosts - enforce network segmentation/VLAN isolation and strict access control lists so only trusted management systems can reach the module's host, which contains exposure to insiders and lateral movement at the cost of tighter operational access. Enable and monitor network and application logging on that segment to detect anomalous unauthenticated access. These controls reduce but do not eliminate risk for anyone already on the trusted segment, so patching remains the priority.