EUVD-2026-61365
GHSA-vxwc-f926-28q5
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Consistent with Oracle's own vector: network-accessible Oracle Net with high complexity, no auth, no UI, full impact on vulnerable system, no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Common Application Objects). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CC Common Application Objects. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of PeopleSoft Enterprise CC Common Application Objects version 9.2 is achievable by an unauthenticated remote attacker via the Oracle Net protocol. Despite the high-severity classification (CVSS 8.1), the attack complexity is rated High, meaning specific technical conditions must be satisfied for exploitation to succeed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network-level reachability to the Oracle Net protocol endpoint on the target PeopleSoft 9.2 instance - no authentication is required per the PR:N CVSS metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 base score reflects network accessibility (AV:N), no required authentication (PR:N), and full system compromise potential (C:H/I:H/A:H), which collectively represent a severe threat profile on paper. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's Critical Patch Update (CPU) for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, scan your environment to identify and inventory all systems running PeopleSoft Enterprise CC 9.2 and confirm exposure of the Oracle Net protocol (default port 1521) to untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthorized data compromise in Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 allows a remote, unauthen
Cross-context data compromise in Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 (Common Application Obje
Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Page a
Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Co
Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Co
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today