What is the CVSS score of EUVD-2026-47429?

EUVD-2026-47429 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L. EPSS exploitation probability: 0.4%.

Which versions of Oracle PeopleSoft are affected by EUVD-2026-47429?

Oracle PeopleSoft Enterprise FIN is vulnerable to unauthenticated remote attacks with near-critical severity (CVSS 9.9), enabling unauthorized access to sensitive financial data and operational…

How to fix or mitigate EUVD-2026-47429?

Within 24 hours, identify all PeopleSoft FIN 9.1 systems and isolate integration components from external networks; review access logs for unauthorized access attempts. Within 7 days, implement strict network segmentation restricting access to administrative networks only, disable non-essential integration endpoints, and escalate to Oracle support for interim technical guidance and available mitigations. Within 30 days, establish a prioritized patch deployment plan; once a vendor patch is released, conduct thorough pre-production testing before rolling out across all affected systems in order of financial criticality.

Oracle PeopleSoft EUVD-2026-47429

| CVE-2026-61237 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-x9gx-654g-fw5r

Authentication Bypass Privilege Escalation Denial Of Service Oracle Peoplesoft Enterprise Fin Common Objects

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

vuln.today AI

9.9 CRITICAL

Unauthenticated HTTP-reachable Integration flaw gives AV:N/AC:L/PR:N/UI:N; scope change per vendor gives S:C; full data read (C:H) with only partial write/DoS (I:L/A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:05 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Integration). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Argentina. While the vulnerability is in PeopleSoft Enterprise FIN Common Objects Argentina, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Argentina accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Common Objects Argentina accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Common Objects Argentina. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L).

AnalysisAI

Unauthenticated remote compromise of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Integration component) allows a network attacker to reach critical data and, because of a scope change, to impact additional PeopleSoft products beyond the vulnerable module. The flaw is rated CVSS 3.1 9.9 and is trivially exploitable over HTTP with no authentication or user interaction, yielding full read of accessible data plus partial write and partial denial-of-service. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the near-maximal score and unauthenticated network vector make it a high-priority patching candidate.

Technical ContextAI

PeopleSoft is Oracle's enterprise ERP/HCM/Financials suite built on the PeopleTools middleware stack, where the Integration Broker and web-facing PIA (PeopleSoft Internet Architecture) servlets accept HTTP requests and route messages between application modules. The affected item, FIN Common Objects Argentina, is a Financials localization module for Argentine statutory/fiscal requirements, and the vulnerable component is Integration - consistent with a defect in message/integration handling that is exposed at the HTTP layer. Oracle did not assign a CWE (CWE: N/A) and does not disclose root-cause detail per its advisory policy; the scope change (S:C) indicates the vulnerable component can affect resources managed by a different security authority, typical of shared integration infrastructure that other PeopleSoft products rely on. No CPE strings were provided in the input, so exact affected configurations rest on Oracle's and ENISA EUVD's version statement of 9.1.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); the input does not include a discrete patched build number, so patch is available per vendor advisory but an exact fix version is not independently confirmed - obtain the specific PeopleTools/Financials patch level referenced for FIN Common Objects Argentina 9.1 from that CPU matrix. Until patching, reduce exposure of the HTTP/Integration surface: restrict network access to the PeopleSoft Internet Architecture and Integration Broker endpoints to trusted internal networks or a VPN, place the PIA behind a reverse proxy/WAF and block direct internet reachability, and tighten Integration Broker node/service configuration to only expose required integration endpoints (trade-off: legitimate external integrations may break and require allowlisting). These are compensating controls only and do not remove the underlying flaw, so schedule the CPU patch as the primary remediation.