What is the CVSS score of CVE-2026-61243?

CVE-2026-61243 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-61243?

Oracle PeopleSoft Enterprise FIN 9.1 Staffing module contains a high-severity vulnerability (CVSS 8.8) enabling existing system users to escalate privileges and gain administrative control of the…

How to fix or mitigate CVE-2026-61243?

Within 24 hours: Inventory all PeopleSoft Enterprise FIN Common Objects 9.1 instances in your environment and identify systems hosting the Staffing component; restrict network access to these systems to authorized personnel only. Within 7 days: Enforce multi-factor authentication for all PeopleSoft system access; deploy enhanced logging and monitoring configured to alert on privilege escalation attempts and unusual account activity from low-privileged users; conduct immediate audit of low-privileged account activities and permission assignments to identify and remediate overprovisioned accounts. Within 30 days: Develop a remediation roadmap for upgrading to a patched version of PeopleSoft Enterprise FIN once Oracle releases available security updates; evaluate compensating technical controls to restrict escalation pathways if upgrade timeline extends beyond 90 days.

Oracle PeopleSoft CVE-2026-61243

EUVD-2026-47434 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-vfhh-fp3j-fxc9

Privilege Escalation Oracle Peoplesoft Enterprise Fin Common Objects

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP access with a low-privilege account and no user interaction yields full module takeover, so PR:L, AC:L, and C/I/A all High, matching Oracle's 8.8.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:03 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Staffing). The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Argentina. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Common Objects Argentina. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privileged, network-based attacker fully compromise the module over HTTP. Oracle rates the flaw CVSS 8.8 with high confidentiality, integrity, and availability impact and classifies it as "easily exploitable," meaning an authenticated user with minimal privileges can escalate to full control of the affected product. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but Oracle's own "easily exploitable" language signals a low barrier once credentials are held.

Technical ContextAI

The affected component is the Financials "Common Objects Argentina" localization within Oracle PeopleSoft Enterprise, a large ERP/HCM suite delivered as a Java/PeopleTools web application typically reached via the PeopleSoft Internet Architecture (PIA) over HTTP(S). The Staffing sub-component handles financial/staffing data flows specific to the Argentine localization. No CWE was assigned by NVD (CWE: N/A), so the precise root-cause class is unspecified; the combination of network HTTP access, low required privilege, and a full compromise outcome is consistent with typical PeopleSoft flaws such as improper access control, injection, or deserialization in an authenticated servlet, but the exact weakness is not disclosed by Oracle's Critical Patch Update summary format.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update - the primary and only vendor-sanctioned remediation - by installing the PeopleSoft patch/bundle referenced at https://www.oracle.com/security-alerts/cpujul2026.html for version 9.1; Oracle CPU summaries do not publish a separate fixed version string, so treat the CPU patch level itself as the fix (Patch available per vendor advisory). Because exploitation requires network HTTP access with low privileges, compensating controls until patching completes include restricting PIA access to the Financials/Argentina staffing pages behind VPN or IP allow-listing, tightening PeopleSoft role/permission-list grants so few users hold the low privilege needed, and monitoring web-server and application logs for anomalous requests to the affected component - with the trade-off that access restrictions may disrupt legitimate regional finance users and are not a substitute for the patch.