Peoplesoft Enterprise Fin Common Objects
Monthly
Full system takeover of Oracle PeopleSoft Enterprise FIN Common Objects 9.2 is achievable by an unauthenticated remote attacker over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Security component and is categorized as difficult to exploit, reflected in the CVSS AC:H rating, suggesting a precision exploitation condition such as a race condition or specific state requirement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the total-takeover impact and unauthenticated network vector make this a high-priority finding for any organization running affected PeopleSoft FIN deployments.
Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privileged, network-based attacker fully compromise the module over HTTP. Oracle rates the flaw CVSS 8.8 with high confidentiality, integrity, and availability impact and classifies it as "easily exploitable," meaning an authenticated user with minimal privileges can escalate to full control of the affected product. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but Oracle's own "easily exploitable" language signals a low barrier once credentials are held.
Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privileged, authenticated attacker send crafted HTTP requests to fully compromise the module and, due to a scope change, impact adjacent PeopleSoft products and data. Rated CVSS 9.9 with full confidentiality, integrity, and availability loss, this is disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eSettlements component) lets an unauthenticated attacker on the adjacent network segment read confidential PeopleSoft data and make limited unauthorized modifications. The flaw carries a scope change, so a successful attack can significantly impact products beyond the vulnerable module. No public exploit identified at time of analysis, and no EPSS or KEV signal is provided; the 8.2 CVSS score is driven by high confidentiality impact plus scope change rather than remote internet exploitability.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker to reach the module over HTTP and achieve high-impact modification of critical data, limited data disclosure, and a partial denial of service. Because Oracle assigns a scope change (S:C), a successful attack can reach beyond the vulnerable module and significantly impact additional PeopleSoft products, which drives the 9.9 CVSS score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. The CVSS 3.1 base score is 9.1 (C:H/I:H, no availability impact) and the flaw is described by Oracle as easily exploitable, with an "Authentication Bypass" tag reinforcing the PR:N vector. No public exploit is identified at time of analysis and it is not listed in CISA KEV; a fix ships in the Oracle Critical Patch Update of July 2026.
Unauthenticated remote compromise of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Integration component) allows a network attacker to reach critical data and, because of a scope change, to impact additional PeopleSoft products beyond the vulnerable module. The flaw is rated CVSS 3.1 9.9 and is trivially exploitable over HTTP with no authentication or user interaction, yielding full read of accessible data plus partial write and partial denial-of-service. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the near-maximal score and unauthenticated network vector make it a high-priority patching candidate.
Unauthenticated information disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Staffing component) lets a remote attacker send crafted HTTP requests to read critical data, potentially achieving complete access to all data accessible to the affected module. Oracle rates it easily exploitable with a CVSS 3.1 base score of 7.5, but the impact is confined to confidentiality (no integrity or availability effect). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (eProcurement component) lets a remote unauthenticated attacker read, create, modify, or delete all data accessible to the module over HTTP. The flaw is rated CVSS 3.1 7.4 with high confidentiality and integrity impact but no availability impact, and is difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor advisory ties the fix to the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Integration component) is possible by an unauthenticated remote attacker over HTTP, with Oracle rating the flaw CVSS 9.8 and describing 'takeover' of the affected module. Disclosed in Oracle's July 2026 Critical Patch Update (CPUJUL2026), the issue affects the Brazilian financial-localization objects of the PeopleSoft Financials suite. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Common Objects component) allows a remote unauthenticated attacker to reach and read critical financial data over HTTP. Oracle rates it easily exploitable with a CVSS 3.1 base of 7.5 and confidentiality-only impact (C:H/I:N/A:N), and it is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of the Oracle PeopleSoft Enterprise FIN Common Objects Brazil module (version 9.1, eProcurement component) is possible by a remote unauthenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation results in complete takeover of the affected component, though Oracle rates the attack as difficult to execute (high attack complexity). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated information disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Purchasing component) lets a remote attacker read critical data over HTTP without any credentials, as disclosed in Oracle's Critical Patch Update of July 2026. Oracle rates it CVSS 7.5 with confidentiality-only impact (C:H/I:N/A:N) and characterizes it as easily exploitable. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Partial denial of service in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 allows unauthenticated remote attackers to disrupt the Cash Management component via HTTP. The vulnerability is rated Medium (CVSS 5.3) with availability-only impact - confidentiality and integrity are unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Integrity compromise in Oracle PeopleSoft Enterprise FIN Common Objects 9.2 allows a low-privileged local attacker to perform unauthorized creation, deletion, or modification of critical financial data when human interaction from another user is obtained. The vulnerability resides in the Security component and carries a CVSS 3.1 base score of 4.4, reflecting high attack complexity and a local-only attack vector. No public exploit code or active exploitation has been identified at time of analysis, and Oracle has disclosed the issue via its July 2026 Critical Patch Update.
Full system takeover of Oracle PeopleSoft Enterprise FIN Common Objects 9.2 is achievable by an unauthenticated remote attacker over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Security component and is categorized as difficult to exploit, reflected in the CVSS AC:H rating, suggesting a precision exploitation condition such as a race condition or specific state requirement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the total-takeover impact and unauthenticated network vector make this a high-priority finding for any organization running affected PeopleSoft FIN deployments.
Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privileged, network-based attacker fully compromise the module over HTTP. Oracle rates the flaw CVSS 8.8 with high confidentiality, integrity, and availability impact and classifies it as "easily exploitable," meaning an authenticated user with minimal privileges can escalate to full control of the affected product. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but Oracle's own "easily exploitable" language signals a low barrier once credentials are held.
Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privileged, authenticated attacker send crafted HTTP requests to fully compromise the module and, due to a scope change, impact adjacent PeopleSoft products and data. Rated CVSS 9.9 with full confidentiality, integrity, and availability loss, this is disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eSettlements component) lets an unauthenticated attacker on the adjacent network segment read confidential PeopleSoft data and make limited unauthorized modifications. The flaw carries a scope change, so a successful attack can significantly impact products beyond the vulnerable module. No public exploit identified at time of analysis, and no EPSS or KEV signal is provided; the 8.2 CVSS score is driven by high confidentiality impact plus scope change rather than remote internet exploitability.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker to reach the module over HTTP and achieve high-impact modification of critical data, limited data disclosure, and a partial denial of service. Because Oracle assigns a scope change (S:C), a successful attack can reach beyond the vulnerable module and significantly impact additional PeopleSoft products, which drives the 9.9 CVSS score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. The CVSS 3.1 base score is 9.1 (C:H/I:H, no availability impact) and the flaw is described by Oracle as easily exploitable, with an "Authentication Bypass" tag reinforcing the PR:N vector. No public exploit is identified at time of analysis and it is not listed in CISA KEV; a fix ships in the Oracle Critical Patch Update of July 2026.
Unauthenticated remote compromise of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Integration component) allows a network attacker to reach critical data and, because of a scope change, to impact additional PeopleSoft products beyond the vulnerable module. The flaw is rated CVSS 3.1 9.9 and is trivially exploitable over HTTP with no authentication or user interaction, yielding full read of accessible data plus partial write and partial denial-of-service. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the near-maximal score and unauthenticated network vector make it a high-priority patching candidate.
Unauthenticated information disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Staffing component) lets a remote attacker send crafted HTTP requests to read critical data, potentially achieving complete access to all data accessible to the affected module. Oracle rates it easily exploitable with a CVSS 3.1 base score of 7.5, but the impact is confined to confidentiality (no integrity or availability effect). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (eProcurement component) lets a remote unauthenticated attacker read, create, modify, or delete all data accessible to the module over HTTP. The flaw is rated CVSS 3.1 7.4 with high confidentiality and integrity impact but no availability impact, and is difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor advisory ties the fix to the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Integration component) is possible by an unauthenticated remote attacker over HTTP, with Oracle rating the flaw CVSS 9.8 and describing 'takeover' of the affected module. Disclosed in Oracle's July 2026 Critical Patch Update (CPUJUL2026), the issue affects the Brazilian financial-localization objects of the PeopleSoft Financials suite. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Common Objects component) allows a remote unauthenticated attacker to reach and read critical financial data over HTTP. Oracle rates it easily exploitable with a CVSS 3.1 base of 7.5 and confidentiality-only impact (C:H/I:N/A:N), and it is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of the Oracle PeopleSoft Enterprise FIN Common Objects Brazil module (version 9.1, eProcurement component) is possible by a remote unauthenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation results in complete takeover of the affected component, though Oracle rates the attack as difficult to execute (high attack complexity). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated information disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Purchasing component) lets a remote attacker read critical data over HTTP without any credentials, as disclosed in Oracle's Critical Patch Update of July 2026. Oracle rates it CVSS 7.5 with confidentiality-only impact (C:H/I:N/A:N) and characterizes it as easily exploitable. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Partial denial of service in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 allows unauthenticated remote attackers to disrupt the Cash Management component via HTTP. The vulnerability is rated Medium (CVSS 5.3) with availability-only impact - confidentiality and integrity are unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Integrity compromise in Oracle PeopleSoft Enterprise FIN Common Objects 9.2 allows a low-privileged local attacker to perform unauthorized creation, deletion, or modification of critical financial data when human interaction from another user is obtained. The vulnerability resides in the Security component and carries a CVSS 3.1 base score of 4.4, reflecting high attack complexity and a local-only attack vector. No public exploit code or active exploitation has been identified at time of analysis, and Oracle has disclosed the issue via its July 2026 Critical Patch Update.