What is the CVSS score of CVE-2026-61242?

CVE-2026-61242 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-61242?

Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 contains a critical account takeover vulnerability (CVSS 9.9) that enables low-privileged users to gain unauthorized access across the…

How to fix or mitigate CVE-2026-61242?

Within 24 hours: Identify all systems running PeopleSoft FIN Common Objects Argentina 9.1 and immediately restrict access to the Staffing component to mission-critical users only; enable detailed audit logging for all authentication events. Within 7 days: Implement multi-factor authentication for all module access, establish network isolation of affected instances from other systems where possible, and deploy automated alerts for suspicious authentication patterns. Within 30 days: Monitor Oracle's security advisories for patch release; execute emergency patching within 48 hours of patch availability.

Oracle PeopleSoft CVE-2026-61242

EUVD-2026-47433 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-m4cx-76r2-g5x6

Authentication Bypass Oracle Peoplesoft Enterprise Fin Common Objects

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network HTTP reach with low complexity and a required low-privilege account gives AV:N/AC:L/PR:L; takeover plus PeopleSoft scope change justifies S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:04 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Staffing). The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Argentina. While the vulnerability is in PeopleSoft Enterprise FIN Common Objects Argentina, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Common Objects Argentina. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privileged, authenticated attacker send crafted HTTP requests to fully compromise the module and, due to a scope change, impact adjacent PeopleSoft products and data. Rated CVSS 9.9 with full confidentiality, integrity, and availability loss, this is disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is part of Oracle PeopleSoft, a Java/PeopleTools-based enterprise ERP suite typically deployed as a web-facing PIA (PeopleSoft Internet Architecture) application server tier fronted by a web server. The specific module is the FIN Common Objects Argentina localization within Financials, invoked via the Staffing component over HTTP. Oracle assigned no CWE (CWE: N/A) and the tag set indicates 'Information Disclosure,' but the CVSS profile (C:H/I:H/A:H with takeover) points to a broader authorization/injection-class flaw reachable by any authenticated portal user rather than a pure read-only leak. The S:C (scope change) metric reflects PeopleSoft's shared component and single-signon architecture, where compromising one module can pivot into other financials objects and the underlying application security context.

RemediationAI

Apply the fixes in the Oracle July 2026 Critical Patch Update - Patch available per vendor advisory (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle did not publish a discrete fixed build number in the provided data, so consult the CPU matrix for the exact PeopleTools/module patch level for version 9.1. Until patched, restrict network access to the PeopleSoft Internet Architecture so the Staffing component and FIN Common Objects Argentina pages are reachable only via VPN or trusted internal networks, and tighten role/permission-list assignments to remove access to the Argentina Staffing objects for users who do not require them (trade-off: may block legitimate Argentine payroll/staffing workflows). Monitor application and web-tier HTTP logs for anomalous requests to the affected component and enforce least-privilege on portal accounts, since exploitation requires only low privileges.