What is the CVSS score of EUVD-2026-47407?

EUVD-2026-47407 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.4%.

Which versions of Peoplesoft Enterprise Fin Expenses are affected by EUVD-2026-47407?

Critical remote unauthenticated vulnerability (CVE-2026-61203) in Oracle PeopleSoft Enterprise FIN Expenses 9.2 enables attackers to read, create, delete, and modify all expense data with no…

How to fix or mitigate EUVD-2026-47407?

Within 24 hours, inventory all systems running PeopleSoft FIN Expenses 9.2, immediately segment network access to restrict HTTP connections to this component to trusted administrative networks only, and enable real-time monitoring of Expenses data access and modifications. Within 7 days, deploy Web Application Firewall (WAF) rules to block malicious HTTP requests targeting the Expenses component, review access logs for signs of unauthorized access or data changes, and establish daily alerting on all administrative operations to the system. Within 30 days, obtain specific patch timeline from Oracle, evaluate upgrading to a patched PeopleSoft version if available, conduct forensic audit of Expenses data for unauthorized modifications, and communicate remediation timeline to finance leadership and compliance/audit functions.

Peoplesoft Enterprise Fin Expenses EUVD-2026-47407

| CVE-2026-61203 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-vfq4-2q5r-3ggf

Authentication Bypass Privilege Escalation Denial Of Service Oracle Peoplesoft Enterprise Fin Expenses

9.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:13 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.4

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Expenses product of Oracle PeopleSoft (component: Expenses). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Expenses. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Expenses accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Expenses accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Expenses. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L).

AnalysisAI

Remote unauthenticated compromise of Oracle PeopleSoft Enterprise FIN Expenses 9.2 (Expenses component) allows attackers with only HTTP network access to read, create, delete or modify all Expenses-accessible data and to cause a partial denial of service. Rated CVSS 3.1 9.4 and flagged by Oracle as easily exploitable, meaning no authentication or user interaction is required. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low-complexity unauthenticated profile makes it a high-priority patch in the July 2026 Oracle Critical Patch Update.