EUVD-2026-62055
GHSA-fj8p-gf7h-7mq2
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network unauthenticated takeover with high complexity aligns with AV:N/AC:H/PR:N; full C/I/A:H reflects total system compromise per Oracle's description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise FIN Common Objects product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Common Objects. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full system takeover of Oracle PeopleSoft Enterprise FIN Common Objects 9.2 is achievable by an unauthenticated remote attacker over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Security component and is categorized as difficult to exploit, reflected in the CVSS AC:H rating, suggesting a precision exploitation condition such as a race condition or specific state requirement. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector PR:N/UI:N confirms exploitation requires no credentials and no user interaction, and AV:N confirms the attack is conducted over the network via HTTP. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.1 is driven by unauthenticated network access with total impact (C:H/I:H/A:H), but is attenuated to below 9.0 by the AC:H metric, which materially lowers the probability of opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's Critical Patch Update published in August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct asset inventory to identify all PeopleSoft FIN 9.2 deployments and map their network exposure; immediately implement network-level access controls restricting HTTP access to PeopleSoft FIN systems to authorized internal networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote compromise of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Integration componen
Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privil
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) a
Full compromise of Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Integration component) is possible by an
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) a
Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privil
Unauthorized data access in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eSettlements component) lets
Full compromise of the Oracle PeopleSoft Enterprise FIN Common Objects Brazil module (version 9.1, eProcurement componen
Unauthenticated information disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Purchasing compone
Unauthenticated information disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Staffing component
Unauthorized data disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Common Objects component) al
Data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (eProcurement component) lets a remote una
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today