What is the CVSS score of CVE-2026-61244?

CVE-2026-61244 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-61244?

A critical authentication bypass in Oracle PeopleSoft Enterprise FIN Manufacturing (Argentina variant, version 9.1) allows unauthenticated remote attackers to read, modify, and delete all…

How to fix or mitigate CVE-2026-61244?

Within 24 hours, inventory all systems running Oracle PeopleSoft Enterprise FIN Manufacturing Argentina 9.1 and assess network exposure; immediately restrict external access to the manufacturing module and disable public-facing HTTP access where possible. Within 7 days, contact Oracle support to confirm patch timeline; implement compensating controls including network segmentation to manufacturing systems, IP allowlisting, Web Application Firewall rules blocking unauthenticated modification requests, and comprehensive audit logging of all data access. Within 30 days, establish formal remediation plan; monitor Oracle's Critical Patch Update schedule weekly; conduct data integrity audit to detect unauthorized modifications; evaluate upgrade to patched versions or alternative ERP solutions.

Oracle PeopleSoft CVE-2026-61244

EUVD-2026-47435 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-m86q-r4v4-r5q9

Authentication Bypass Oracle Peoplesoft Enterprise Fin Manufacturing Argentina

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated remote HTTP access (AV:N/PR:N/UI:N) with low complexity yields high confidentiality and integrity impact; no availability impact per the description, so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:03 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Manufacturing Argentina product of Oracle PeopleSoft (component: Manufacturing). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Manufacturing Argentina. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Manufacturing Argentina accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Manufacturing Argentina accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated data compromise in Oracle PeopleSoft Enterprise FIN Manufacturing Argentina 9.1 (Manufacturing component) lets a remote attacker read, create, modify, or delete all data accessible to the module over HTTP with no credentials. Oracle rates it CVSS 3.1 9.1 (Confidentiality and Integrity High, Availability None); it was disclosed in the Oracle Critical Patch Update of July 2026 and carries an 'Authentication Bypass' tag. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected software is Oracle's PeopleSoft Enterprise financials suite, specifically the FIN Manufacturing localization for Argentina, running on the PeopleTools web/application server stack that exposes functionality via HTTP. Oracle did not assign a CWE (CWE: N/A), but the vendor 'Authentication Bypass' tag combined with the PR:N vector points to a root cause in the class of improper authentication / missing access control, where a request reaches privileged Manufacturing functionality without a validated session. Because PeopleSoft applications are typically fronted by the PIA (PeopleSoft Internet Architecture) servlet layer, the flaw most plausibly resides in a servlet or integration endpoint that fails to enforce authentication before granting read/write access to Manufacturing data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory, though no discrete fixed build number is stated in the input, so consult the CPU patch matrix for the exact PeopleSoft/PeopleTools patch level for your environment. Because this is an unauthenticated network flaw, until patching is complete restrict network reachability to the PeopleSoft Internet Architecture front end: place the application behind a VPN or IP allowlist, block external HTTP/HTTPS access to the Manufacturing module endpoints at the reverse proxy or WAF, and disable or unpublish the FIN Manufacturing Argentina functionality if it is not in active use. Trade-offs: IP/VPN restriction and WAF blocking may impede legitimate remote or integration access to the module, and unpublishing the component will break any workflows that depend on it, so validate against business processes before applying.