PeopleSoft Enterprise CVE-2026-70861

Exploitation requires network-level access to the PeopleSoft Enterprise FIN Common Objects Brazil 9.1 instance via Oracle's T3 or IIOP protocols, which are WebLogic-based communication channels. A high-privileged account within the PeopleSoft environment (PR:H per CVSS) is mandatory - this restricts exploitation to PeopleSoft administrators, users with elevated application roles, or attackers who have previously stolen or escalated to such credentials. The vulnerability is scoped exclusively to the Brazil-specific financial module and version 9.1; no other PeopleSoft versions or modules are confirmed affected. No user interaction is required once the attacker holds valid high-privileged credentials and network connectivity. Limiting factors include: the PR:H prerequisite (unauthenticated or low-privileged users cannot exploit this flaw), the Brazil module specificity (deployments not using PeopleSoft FIN Brazil are not affected), and network reachability to T3/IIOP ports (perimeter firewall controls that restrict these ports reduce exposure).

The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity flaw that nonetheless requires high-privileged credentials, substantially narrowing the realistic attacker pool to insiders, credential-compromised administrators, or attackers who have previously escalated access. Oracle's advisory labels this 'easily exploitable,' which in this context means exploitation is mechanically straightforward once credentials are in hand - not that it is opportunistically reachable by anonymous actors. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified. The vulnerability is absent from CISA KEV and no POC is known, indicating no observed widespread exploitation. The unscoped impact (S:U) means compromise is contained to the PeopleSoft component itself and does not imply lateral pivot to adjacent systems via this flaw alone. Real-world priority is moderate: high severity for PeopleSoft FIN Brazil 9.1 environments where admin credential hygiene is weak, but low urgency for organizations with strict privileged access controls.

A PeopleSoft administrator - or an attacker who has obtained high-privileged credentials through phishing, credential stuffing, or prior lateral movement - connects to the target system over the network via T3 or IIOP and sends a crafted request to the Common Objects component of the FIN Brazil module. Because attack complexity is low, no race conditions or non-standard configurations are required beyond the privileged session. Successful exploitation results in full system takeover, enabling exfiltration of sensitive Brazilian financial records, manipulation of financial transactions, or service disruption.