Oracle PeopleSoft CVE-2026-61242

Exploitation requires authenticated access at a low privilege level (CVSS PR:L) to the PeopleSoft Internet Architecture and HTTP reachability to the FIN Common Objects Argentina Staffing component on version 9.1 - the attacker must hold at least a basic PeopleSoft portal account. No user interaction is required (UI:N) and complexity is low (AC:L), so a single valid low-tier credential against a network-exposed instance is sufficient. Limiting factors: the target must run the Argentina financials localization module (a country-specific deployment, not present in every PeopleSoft install), the specific supported version 9.1 must be in use, and the attacker needs valid credentials, so a purely anonymous internet attacker cannot exploit it without first obtaining an account.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) signals a genuinely high-priority issue: network-reachable over HTTP, low attack complexity, only low privileges required, no user interaction, and full CIA impact with scope escalation. Any legitimate low-privileged PeopleSoft user could achieve module takeover, which is a realistic insider or credential-theft threat given how many users hold accounts in ERP portals. Countervailing signals temper urgency: this is not in CISA KEV, no proof-of-concept or exploit code is referenced, and no EPSS probability was supplied, so real-world exploitation likelihood cannot be quantified from the data. The 'Information Disclosure' tag is narrower than the CVSS integrity/availability impacts and Oracle's 'takeover' language - treat the CVSS-derived impact as authoritative and the tag as an incomplete label. Net: high real risk warranting prompt patching, but active exploitation is unconfirmed and appears aspirational/targeted rather than mass-scanned at this time.

A low-privileged employee or an attacker who has phished a single ordinary PeopleSoft portal credential logs into the PIA and sends a crafted HTTP request to the FIN Common Objects Argentina Staffing component. Because attack complexity is low and no user interaction is needed, the request abuses the flaw to take over the module and, via the scope change, reach financial data and objects beyond the user's normal authorization. No public POC is referenced, so an attacker would need to independently develop the exploit.