Oracle PeopleSoft CVE-2026-61243

Exploitation requires network reachability to the PeopleSoft web tier over HTTP and a valid low-privilege PeopleSoft account (CVSS PR:L) - it is NOT unauthenticated. The specific prerequisite is that the target deployment runs the PeopleSoft Enterprise FIN Common Objects Argentina localization version 9.1 with the Staffing component in use, a niche, region-specific configuration that limits the exposed population. Limiting factors: an attacker must first obtain or hold credentials at some privilege level, and only environments that have deployed this Argentine Financials localization are affected; no special non-default toggle is named in the description beyond the presence of the affected product, and no user interaction is required (UI:N).

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) indicates remote, low-complexity exploitation needing only low privileges and no user interaction, with total impact on the module - a genuinely serious signal for any environment running this localization. However, key real-world signals are missing: no EPSS score, no CISA KEV listing, and no POC were provided, so there is no evidence of active or imminent widespread exploitation despite the high base score. There is also a data conflict worth flagging: the intelligence tag reads "Information Disclosure" (implying confidentiality-only impact), yet Oracle's description and vector assert full takeover with high integrity and availability impact - trust the CVSS vector over the tag, but verify scope with Oracle. Net: a high-priority patch for organizations actually running PeopleSoft Financials with the Argentina localization, but likely lower urgency for the broader population given the niche, region-specific module and absence of exploitation evidence.

An attacker who holds a low-privilege PeopleSoft account (for example, a legitimate finance user, a compromised low-tier credential, or a self-registered account) sends crafted HTTP requests to the FIN Common Objects Argentina Staffing component over the PeopleSoft Internet Architecture. Because the flaw is low-complexity and needs no user interaction, the request escalates the attacker to full control of the module, allowing them to read, alter, or destroy financial data. No public exploit code was identified at time of analysis, so this would currently require attacker-developed tooling.