What is the CVSS score of CVE-2026-61245?

CVE-2026-61245 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-61245?

A critical vulnerability in Oracle PeopleSoft Enterprise FIN Manufacturing Brazil 9.1 allows complete system compromise by unauthenticated remote attackers, directly threatening financial data…

How to fix or mitigate CVE-2026-61245?

Within 24 hours, complete inventory of all PeopleSoft FIN Manufacturing Brazil 9.1 instances and implement firewall rules to restrict network access to the Integration component, limiting exposure to authorized network segments only. Within 7 days, deploy comprehensive logging and monitoring on all affected systems to detect exploitation attempts, and establish direct contact with Oracle Support to confirm patch availability timelines and obtain any interim guidance. Within 30 days, maintain defensive posture while awaiting vendor patch; if patch release extends beyond 30 days, initiate formal evaluation of system isolation options, temporary workarounds, or migration to patched versions as business continuity planning.

Oracle PeopleSoft CVE-2026-61245

EUVD-2026-47436 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-jfp2-vxm7-rhq5

Authentication Bypass Oracle Peoplesoft Enterprise Fin Manufacturing Brazil

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easily-exploitable unauthenticated network access over HTTPS resulting in takeover, so AV:N/AC:L/PR:N/UI:N with full C/I/A High and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:03 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Manufacturing Brazil product of Oracle PeopleSoft (component: Integration). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise FIN Manufacturing Brazil. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Manufacturing Brazil. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle PeopleSoft Enterprise FIN Manufacturing Brazil 9.1 is possible when an unauthenticated remote attacker reaches the vulnerable Integration component over HTTPS. Oracle rates this 9.8 (CVSS 3.1) with high confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning no authentication, privileges, or user interaction are required. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low-complexity unauthenticated profile makes it a priority patch in the Oracle July 2026 Critical Patch Update.

Technical ContextAI

The affected software is Oracle's PeopleSoft Enterprise Financials suite, specifically the Brazil-localized Manufacturing (FIN Manufacturing Brazil) module running on the PeopleTools application-server stack, and the vulnerable subsystem is the Integration component - typically the Integration Broker / integration gateway that handles inbound service operations and message routing over HTTP/HTTPS. Oracle publishes no CWE for this issue (CWE: N/A) and does not disclose root-cause internals in the CPU advisory, but the 'takeover' outcome combined with an unauthenticated HTTPS vector is consistent with the class of integration-gateway flaws (authentication bypass, unsafe deserialization, or injection in message handling) historically seen in PeopleSoft Integration Broker. The Oracle-supplied tag 'Information Disclosure' is present, but the CVSS vector's C:H/I:H/A:H and explicit 'takeover' language indicate impact well beyond disclosure alone.

RemediationAI

Vendor-released patch: apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for PeopleSoft Enterprise FIN Manufacturing Brazil 9.1; the CPU advisory is the definitive source for the specific patch set and PeopleTools level required. Because the exposure is through the Integration component over HTTPS, if patching cannot be completed immediately, reduce attack surface by restricting network access to the Integration Broker / integration gateway and PIA endpoints so they are reachable only from trusted internal networks or via VPN rather than the public internet, and place the application behind a WAF or reverse proxy that allow-lists integration service operations - noting the trade-off that legitimate external integration partners may lose connectivity and must be explicitly allow-listed. Disabling or firewalling any unused integration gateway listeners further shrinks exposure. These are compensating controls only; the CPU patch is the sole confirmed fix.