EUVD-2026-61811
GHSA-8hcf-f7w2-f5q3
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network access via T3/IIOP with no special complexity, but high-privilege credential mandatory; full takeover warrants C:H/I:H/A:H with no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Common Objects). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker with network access via T3, IIOP to compromise PeopleSoft Enterprise FIN Common Objects Brazil. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Common Objects Brazil. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of PeopleSoft Enterprise FIN Common Objects Brazil 9.1 is achievable by a high-privileged attacker with network access using Oracle's T3 or IIOP protocols. The vulnerability carries a CVSS 3.1 score of 7.2, reflecting complete confidentiality, integrity, and availability impact despite the PR:H prerequisite. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network-level access to the PeopleSoft Enterprise FIN Common Objects Brazil 9.1 instance via Oracle's T3 or IIOP protocols, which are WebLogic-based communication channels. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity flaw that nonetheless requires high-privileged credentials, substantially narrowing the realistic attacker pool to insiders, credential-compromised administrators, or attackers who have previously escalated access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory - organizations should apply Oracle's August 2026 Critical Patch Update, referenced at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately identify and document all PeopleSoft Enterprise FIN Common Objects Brazil 9.1 instances and audit which high-privilege accounts have network access via Oracle T3 or IIOP protocols. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today