PeopleSoft FIN Argentina CVE-2026-70860

Exploitation requires an authenticated low-privileged account (PR:L) with network access to the PeopleSoft Enterprise FIN Common Objects Argentina eProcurement component over HTTP, and the deployment must be running the affected version 9.1 with the Argentina financial localization enabled. The CVSS AC:H rating indicates success depends on conditions beyond the attacker's direct control (e.g., specific application state, timing, or configuration), making reliable exploitation difficult. Limiting factors: pre-existing authentication is mandatory (no unauthenticated access), the Argentina-specific module must be deployed, and the high attack complexity reduces repeatability - no victim user interaction is required (UI:N).

This is a moderate-risk issue that is unlikely to be a top-priority emergency. The CVSS 3.1 base score is 5.9 (Medium) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N: network-reachable over HTTP but with HIGH attack complexity (AC:H) and requiring an already-authenticated low-privileged account (PR:L). The primary impact is to integrity (I:H - unauthorized creation/deletion/modification of critical data) with limited confidentiality (C:L) and no availability impact. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, so this is not confirmed as actively exploited. The combination of high complexity plus required privileges materially lowers real-world risk versus the raw score; the value sits in integrity impact to financial ERP data rather than easy mass exploitation. One data caveat: the input carries an 'Authentication Bypass' tag, which conflicts with the PR:L vector and the description's 'low privileged attacker' language (exploitation requires, not bypasses, authentication) - treat that tag as suspect and verify against Oracle's advisory.

A user who already holds a low-privileged account on the PeopleSoft Enterprise FIN Common Objects Argentina (eProcurement) application sends crafted HTTP requests to the application that, under specific conditions outside the attacker's full control (AC:H), bypass authorization checks on financial data. The attacker leverages this to read a subset of accessible data and to create, modify, or delete critical PeopleSoft data. No public proof-of-concept exploit is identified at time of analysis, and no user interaction by a victim is required.