PeopleSoft Enterprise FIN CVE-2026-71112

The CVSS vector PR:N/UI:N confirms exploitation requires no credentials and no user interaction, and AV:N confirms the attack is conducted over the network via HTTP. The limiting factor is AC:H (high attack complexity): exploitation is not straightforward and requires meeting a specific condition beyond the attacker's direct control, such as a race condition, a precise application state, or a non-obvious protocol interaction within the PeopleSoft Security component. The description does not specify a required non-default configuration setting or feature enablement, meaning any standard deployment of PeopleSoft Enterprise FIN Common Objects 9.2 with HTTP access may be in scope. Exploitation is constrained by the AC:H requirement: attacks are unlikely to succeed in a single naive attempt and may require repeated, targeted interaction with the application. Organizations with PeopleSoft FIN exposed only on internal networks behind authenticated VPN boundaries substantially reduce practical exploitability despite the network attack vector.

The CVSS 3.1 score of 8.1 is driven by unauthenticated network access with total impact (C:H/I:H/A:H), but is attenuated to below 9.0 by the AC:H metric, which materially lowers the probability of opportunistic mass exploitation. No EPSS score is provided in the available intelligence, preventing probabilistic comparison. The absence of a CISA KEV listing and any public exploit code at time of analysis suggests this is not yet under active widespread exploitation, though that status can change rapidly for Oracle ERP vulnerabilities following CPU publication. The scope is unchanged (S:U), meaning exploitation does not pivot laterally to adjacent systems by default. Even a mid-sized municipal IT team in tczew managing a PeopleSoft FIN 9.2 deployment with internet-facing HTTP services should treat this as urgent given the AC:H barrier does not preclude a sufficiently motivated and capable threat actor from achieving full takeover. The 'Information Disclosure' tag in the source intelligence conflicts with the full C/I/A:H impact - defenders should not rely on the tag and should instead treat this as a full compromise scenario per the CVSS description.

A remote, unauthenticated attacker identifies a publicly accessible PeopleSoft Enterprise FIN Common Objects 9.2 HTTP endpoint and sends a sequence of carefully crafted HTTP requests designed to satisfy the high-complexity exploitation condition - such as a race condition or specific application state - within the Security component. Upon successfully triggering the condition, the attacker achieves complete control over the PeopleSoft FIN instance, enabling exfiltration of financial records, modification of transaction data, or disruption of service. No public exploit code has been identified at time of analysis, meaning current exploitation is likely limited to advanced actors with independent vulnerability research capability.