EUVD-2026-47435
GHSA-m86q-r4v4-r5q9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach PeopleSoft PIA web tier over HTTP
-
ExploitSend crafted request to Manufacturing endpoint
-
ExecutionBypass authentication
-
ImpactRead or modify critical Manufacturing data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to a deployed and reachable instance of the PeopleSoft Enterprise FIN Manufacturing Argentina 9.1 Manufacturing component; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, privileges, or user interaction are needed against that endpoint. The chief limiting factors are deployment-based rather than technical: the target must actually run the Argentina Manufacturing localization module at version 9.1, and the PeopleSoft Internet Architecture front end must be reachable from the attacker's network position - instances confined to an internal segment or behind VPN/WAF are correspondingly harder to reach. No non-default configuration, specific platform, or user action is indicated by the available data. |
| Impact | The signals are largely consistent on the surface but incomplete in depth. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes an easily exploitable, network-facing, unauthenticated flaw with high confidentiality and integrity impact and no availability impact - a genuine high-priority profile if the vulnerable module is internet-reachable. However, several risk-lowering factors exist: no EPSS score was provided, the CVE is not in CISA KEV (so no confirmed active exploitation), and no POC or exploit code is referenced, so real-world exploitation probability cannot be quantified from the input. Oracle CPU advisories are also deliberately terse, so the exact endpoint and preconditions are not disclosed. Net: treat as high priority for organizations that actually run the Argentina Manufacturing module (patch promptly), but recognize the practical exposure is bounded by how narrowly this regional module is deployed and whether it is exposed beyond the internal network. |
| Exploit ScenarioDerived | An attacker who can reach the PeopleSoft web tier over HTTP sends a crafted request to the vulnerable FIN Manufacturing Argentina endpoint without providing valid credentials, bypassing authentication. They then read sensitive manufacturing/financial records and create, alter, or delete critical data accessible to the module. No POC is publicly identified at this time, and the low attack complexity (AC:L) with no required privileges or user interaction means exploitation would be straightforward once the specific endpoint is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Unauthenticated data compromise in Oracle PeopleSoft Enterprise FIN Manufacturing Argentina 9.1 (Manufacturing component) lets a remote attacker read, create, modify, or delete all data accessible to the module over HTTP with no credentials. Oracle rates it CVSS 3.1 9.1 (Confidentiality and Integrity High, Availability None); it was disclosed in the Oracle Critical Patch Update of July 2026 and carries an 'Authentication Bypass' tag. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory, though no discrete fixed build number is stated in the input, so consult the CPU patch matrix for the exact PeopleSoft/PeopleTools patch level for your environment. Because this is an unauthenticated network flaw, until patching is complete restrict network reachability to the PeopleSoft Internet Architecture front end: place the application behind a VPN or IP allowlist, block external HTTP/HTTPS access to the Manufacturing module endpoints at the reverse proxy or WAF, and disable or unpublish the FIN Manufacturing Argentina functionality if it is not in active use. Trade-offs: IP/VPN restriction and WAF blocking may impede legitimate remote or integration access to the module, and unpublishing the component will break any workflows that depend on it, so validate against business processes before applying.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected software is Oracle's PeopleSoft Enterprise financials suite, specifically the FIN Manufacturing localization for Argentina, running on the PeopleTools web/application server stack that exposes functionality via HTTP. Oracle did not assign a CWE (CWE: N/A), but the vendor 'Authentication Bypass' tag combined with the PR:N vector points to a root cause in the class of improper authentication / missing access control, where a request reaches privileged Manufacturing functionality without a validated session. Because PeopleSoft applications are typically fronted by the PIA (PeopleSoft Internet Architecture) servlet layer, the flaw most plausibly resides in a servlet or integration endpoint that fails to enforce authentication before granting read/write access to Manufacturing data.
Know when Peoplesoft Enterprise Fin Manufacturing Argentina gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated remote HTTP access (AV:N/PR:N/UI:N) with low complexity yields high confidentiality and integrity impact; no availability impact per the description, so A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise FIN Manufacturing Argentina product of Oracle PeopleSoft (component: Manufacturing). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Manufacturing Argentina. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Manufacturing Argentina accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Manufacturing Argentina accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
A critical authentication bypass in Oracle PeopleSoft Enterprise FIN Manufacturing (Argentina variant, version 9.1) allows unauthenticated remote attackers to read, modify, and delete all manufacturing data without credentials. This exposes production orders, inventory records, and financial data to complete compromise across the manufacturing module. With no patch currently available, organizations must implement immediate network containment to prevent data breach and operational disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: Restrict manufacturing module access to internal networks only via IP allowlisting; deploy Web Application Firewall with rules to block data modification and deletion from unauthenticated sessions; enable comprehensive audit logging of all manufacturing data access and changes; implement database-level row-level security to limit accessible data; consider air-gapping production systems until patch is available; maintain read-only replica for recovery purposes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB