PeopleSoft FIN EUVD-2026-106713

Exploitation requires network access to the affected component specifically via the Oracle Net protocol (the Oracle database/application networking layer), targeting the Integration component of PeopleSoft Enterprise FIN Common Objects Argentina version 9.1. No authentication, no privileges, and no user interaction are needed (PR:N/UI:N), so default-configuration deployments reachable over Oracle Net are exposed. The principal limiting factors are: (1) the Oracle Net listener/endpoint must be network-reachable from the attacker - environments that restrict Oracle Net to trusted internal segments or firewall it from untrusted networks sharply reduce exposure; (2) only the Argentina financials localization at version 9.1 is affected, limiting the population of vulnerable installations; and (3) impact is confined to confidentiality (data disclosure) - no data modification or service disruption results.

This is a genuinely significant but bounded issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) is self-consistent with the description: a network-reachable, low-complexity, unauthenticated flaw with no user interaction, exploitable over Oracle Net. The impact is strictly confidentiality (C:H, with I:N/A:N), so this is a data-disclosure problem, not a code-execution or integrity/availability event. Key exploitation-prioritization signals are MISSING from the provided intelligence: there is no EPSS score, no CISA KEV listing, and no POC indicator, so exploitation status is 'no public exploit identified at time of analysis.' The absence of EPSS/KEV/POC is not evidence of safety - it reflects data gaps, not low risk. One contradiction to flag: the input Tags label this 'Authentication Bypass,' yet the CVSS vector shows PR:N (no privileges to bypass) and the description frames it as unauthenticated data access over Oracle Net - this looks like a direct unauthorized-access/disclosure flaw rather than a true authentication-bypass, so treat the tag with caution. Net assessment: a real priority for Oracle PeopleSoft Financials operators running the affected Argentina localization on v9.1, but it should be ranked below any RCE/integrity CVEs in the same Oracle CPU given the confidentiality-only impact.

An unauthenticated attacker with network reachability to the PeopleSoft Enterprise FIN Common Objects Argentina Integration component sends crafted traffic over the Oracle Net protocol to the exposed service. Because no authentication, privileges, or user interaction are required and attack complexity is low, the attacker retrieves or gains unauthorized access to critical financial data. No public exploit code or active exploitation is identified at the time of analysis.