What is the CVSS score of EUVD-2026-47298?

EUVD-2026-47298 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle PeopleSoft are affected by EUVD-2026-47298?

Oracle PeopleSoft Enterprise FIN Payables 9.2 contains an unauthenticated data disclosure vulnerability allowing remote attackers to bypass authentication and read sensitive financial data without…

How to fix or mitigate EUVD-2026-47298?

Within 24 hours: Restrict remote HTTP access to PeopleSoft Payables 9.2 to authorized internal networks only using firewall rules; enable comprehensive audit logging for all access attempts to the Payables module; escalate to Oracle Support with CVE-2026-61087 reference to confirm patch status and expected release timeline. Within 7 days: Implement network segmentation isolating Payables application from untrusted networks; deploy Web Application Firewall (WAF) rules to block unauthenticated requests to Payables endpoints; conduct forensic review of access logs dating to early July 2026 for indicators of exploitation. Within 30 days: Complete forensic analysis of all Payables module data access to identify any unauthorized disclosures; execute inventory of financial data elements exposed by this vulnerability; apply vendor patch immediately upon release and validate remediation; notify relevant business stakeholders and compliance teams of any confirmed unauthorized access.

Oracle PeopleSoft EUVD-2026-47298

| CVE-2026-61087 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-55rw-3wq3-mf7q

Authentication Bypass Oracle Peoplesoft Enterprise Fin Payables

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network HTTP access with low complexity and no user interaction (auth-bypass tag confirms PR:N); read-only data exposure gives C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:55 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Payables product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Payables. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Payables accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthenticated data disclosure in Oracle PeopleSoft Enterprise FIN Payables 9.2 (Security component) lets a remote attacker reach financial data over HTTP without credentials, yielding read access to critical or all data the Payables module can reach. The Oracle-supplied tag of 'Authentication Bypass' aligns with the CVSS PR:N vector, indicating the flaw circumvents access controls. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but its low complexity and network reach make it a credible target once details from the July 2026 CPU are studied.

Technical ContextAI

PeopleSoft Enterprise FIN Payables is the accounts-payable module of Oracle's PeopleSoft ERP suite, delivered as a web-based application typically fronted by PeopleSoft PIA (PeopleSoft Internet Architecture) over HTTP/HTTPS on a WebLogic/Tomcat servlet tier backed by a Tuxedo application server and a relational database. The affected 'Security' component and the vendor-supplied 'Authentication Bypass' tag point to a defect in the authentication/authorization enforcement path rather than in business logic, so a request that should require a valid session or entitlement is instead honored. No CWE was assigned in the source data; based on the confidentiality-only impact and auth-bypass tag, the root-cause class is most likely improper authentication or missing authorization (CWE-287/CWE-306/CWE-862), but this is inferred, not confirmed.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle distributes PeopleSoft security fixes as CPU patch bundles and PeopleTools/PeopleSoft Update Images rather than a single named release, so identify the specific CVE-2026-61087 patch for FIN Payables 9.2 in the CPU matrix and apply it - an exact standalone fix version was not provided in the source data and should be confirmed from the CPU. Until patched, restrict network exposure of the PeopleSoft Internet Architecture (PIA) web tier so it is not reachable from untrusted networks - place it behind a VPN or IP allowlist and, where feasible, put a WAF or reverse proxy in front to filter anomalous requests to the Payables servlets; the trade-off is that overly aggressive filtering or access restriction can disrupt legitimate remote and integration users, so validate rules against known PeopleSoft URL patterns before enforcing. Also review web-tier and application-server logs for unexpected unauthenticated access to Payables endpoints.