Oracle PeopleSoft CVE-2026-61245

The prerequisite is network reachability to the PeopleSoft Integration component (integration gateway/Integration Broker) over HTTPS on an instance running FIN Manufacturing Brazil version 9.1; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no special configuration, authentication, privilege, or user-interaction requirement stated, so this is effectively remote unauthenticated exploitation against affected PeopleSoft Enterprise FIN Manufacturing Brazil 9.1 deployments. The primary limiting factors are deployment-scope rather than technical: only the Brazil-localized FIN Manufacturing module at version 9.1 is named as affected, and exploitation requires the integration endpoint to be network-accessible to the attacker - organizations that expose the integration gateway only on internal or VPN-restricted networks substantially reduce realistic exposure.

All available severity signals point the same direction: CVSS 3.1 base score 9.8 with AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H means network-reachable, low-complexity, unauthenticated exploitation with total compromise of the target, and Oracle explicitly calls it 'easily exploitable,' reinforcing the low attack complexity. However, several corroborating signals are absent from the input: no EPSS probability was provided, the CVE is not listed in CISA KEV (no confirmed active exploitation), and no public proof-of-concept is referenced - so this is currently a high-severity, high-theoretical-risk issue rather than a confirmed exploited-in-the-wild one. There is a mild internal inconsistency worth flagging: the Oracle tag says 'Information Disclosure' yet the vector and text describe full takeover (C/I/A all High); the vector and 'takeover' wording should be treated as authoritative over the tag. No SSVC decision record was supplied. Net assessment: treat as a top-tier patch priority because of the unauthenticated network takeover profile, while recognizing that real-world exploitation breadth is unproven and the affected module is a niche localization.

An attacker who can reach the PeopleSoft integration endpoint over HTTPS from the internet or an adjacent network sends a crafted request to the vulnerable Integration component without needing any credentials or user interaction. Because attack complexity is low and no authentication is required, a successful request yields full takeover of the PeopleSoft Enterprise FIN Manufacturing Brazil application, letting the attacker read, alter, or destroy financial and manufacturing data and pivot further into the environment. No public proof-of-concept is currently identified, so exploitation would require the attacker to independently develop the technique.