What is the CVSS score of EUVD-2026-47424?

EUVD-2026-47424 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle PeopleSoft are affected by EUVD-2026-47424?

Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 contains an unauthenticated remote vulnerability enabling direct HTTP access to critical financial data.

How to fix or mitigate EUVD-2026-47424?

Within 24 hours: inventory all Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 instances in your environment, assess their network accessibility, and enable detailed HTTP access logging to this component. Within 7 days: review recent access logs for anomalous queries to financial data tables, implement firewall rules restricting HTTP access to this application exclusively to authorized internal networks, and contact Oracle support for timelines on the July 2026 Critical Patch Update. Within 30 days: test the patch in staging and deploy Oracle's July 2026 Critical Patch Update to all affected systems once validated.

Oracle PeopleSoft EUVD-2026-47424

| CVE-2026-61232 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-6q8m-v4v8-r62x

Authentication Bypass Oracle Peoplesoft Enterprise Fin Common Objects

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated HTTP-reachable data exposure (AV:N/AC:L/PR:N/UI:N) with full confidentiality loss but no integrity or availability impact, matching Oracle's 'easily exploitable' description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:08 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Common Objects). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Brazil. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Brazil accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Common Objects component) allows a remote unauthenticated attacker to reach and read critical financial data over HTTP. Oracle rates it easily exploitable with a CVSS 3.1 base of 7.5 and confidentiality-only impact (C:H/I:N/A:N), and it is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is part of Oracle PeopleSoft, a widely used enterprise ERP/HCM/Financials suite typically deployed via the PeopleSoft Internet Architecture (PIA) web/application tier reachable over HTTP. The specific asset is the FIN Common Objects Brazil localization within the Common Objects component, i.e. shared Brazilian financials objects used by the Financials/Supply Chain modules. Oracle did not assign a CWE (CWE: N/A), but the vendor-supplied 'Authentication Bypass' tag combined with a confidentiality-only, unauthenticated network vector points to a missing/broken access-control or authentication weakness (broadly CWE-287 Improper Authentication or CWE-306 Missing Authentication) that exposes data intended to be restricted. No CPE was provided in the intelligence; affected scope is defined by Oracle/EUVD version metadata rather than CPE strings.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for PeopleSoft Enterprise FIN Common Objects Brazil 9.1; Oracle did not publish a discrete point-release version number in the supplied data, so identify the exact PeopleTools/patch bundle from the CPU risk matrix. Until the CPU can be applied, reduce exposure by restricting network reachability of the PeopleSoft Internet Architecture (PIA) web tier - place it behind a VPN or trusted-network boundary and block untrusted HTTP access to the affected FIN Common Objects Brazil endpoints/servlets, accepting that this may inconvenience remote or partner users who legitimately need the Brazil financials functionality. Add WAF/reverse-proxy rules to limit access to the affected component and increase monitoring of the PIA access logs for anomalous unauthenticated requests to Brazilian financials objects; these are compensating controls only and do not remove the underlying flaw.