What is the CVSS score of EUVD-2026-47284?

EUVD-2026-47284 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Peoplesoft Enterprise Fin Common Objects are affected by EUVD-2026-47284?

Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 contains an unauthenticated remote vulnerability enabling unauthorized access to critical purchasing and financial data.

How to fix or mitigate EUVD-2026-47284?

Within 24 hours, inventory all systems running PeopleSoft FIN Brazil 9.1 and verify network exposure from untrusted sources; contact Oracle support for interim guidance. Within 7 days, implement network-layer access controls restricting HTTP(S) access to the Purchasing component to authorized internal networks only, and apply any Oracle-provided workarounds or configuration hardening steps. Within 30 days, monitor Oracle's Critical Patch Update schedule for release of CVE-2026-61073 remediation; plan and execute patch deployment immediately upon vendor release, or evaluate upgrade to unaffected PeopleSoft versions if patches remain unavailable.

Peoplesoft Enterprise Fin Common Objects EUVD-2026-47284

| CVE-2026-61073 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-xfm6-92pv-pqg3

Authentication Bypass Oracle Peoplesoft Enterprise Fin Common Objects

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:58 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Brazil. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Brazil accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthenticated information disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Purchasing component) lets a remote attacker read critical data over HTTP without any credentials, as disclosed in Oracle's Critical Patch Update of July 2026. Oracle rates it CVSS 7.5 with confidentiality-only impact (C:H/I:N/A:N) and characterizes it as easily exploitable. No public exploit code and no CISA KEV listing have been identified at time of analysis.