CVE-2026-61073: PeopleSoft Enterprise Auth Bypass Flaw

CVE-2026-61073 Overview

CVE-2026-61073 is a high-severity information disclosure vulnerability affecting Oracle PeopleSoft Enterprise FIN Common Objects Brazil, specifically within the Purchasing component. The flaw exists in version 9.1 and can be exploited by an unauthenticated remote attacker over HTTP. Successful exploitation grants unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Brazil accessible data. Oracle disclosed the issue as part of the July 2026 Critical Patch Update.

Critical Impact
An unauthenticated network attacker can read sensitive financial and procurement data from vulnerable PeopleSoft Enterprise FIN Common Objects Brazil deployments with no user interaction required.

Affected Products

Oracle PeopleSoft Enterprise FIN Common Objects Brazil version 9.1
Component: Purchasing
Deployments exposing PeopleSoft HTTP interfaces to untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-61073 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-61073

Vulnerability Analysis

The vulnerability resides in the Purchasing component of Oracle PeopleSoft Enterprise FIN Common Objects Brazil. An attacker with network access via HTTP can reach an exposed endpoint and retrieve data without providing credentials. Oracle characterizes the flaw as easily exploitable, indicating no specialized conditions, timing, or user interaction are required to trigger the disclosure.

The impact is scoped to confidentiality. Integrity and availability of the affected component are not directly impacted, but the exposed data can include procurement records, supplier information, financial identifiers, and other business-sensitive artifacts stored in the module. Because PeopleSoft financial modules frequently hold regulated data, secondary risks include downstream fraud, targeted phishing, and compliance violations.

Root Cause

Oracle has not published the underlying code-level root cause. The advisory language — unauthenticated HTTP access leading to unauthorized data disclosure — is consistent with missing or improper access control on a Purchasing-related resource within the FIN Common Objects Brazil module. Public technical details are limited pending Oracle's standard non-disclosure practice for Critical Patch Update entries.

Attack Vector

Exploitation requires only network reachability to the PeopleSoft HTTP interface. The attacker sends crafted HTTP requests against the vulnerable Purchasing endpoint and receives back sensitive data belonging to the module. No credentials, tokens, session cookies, or victim interaction are needed. Internet-exposed PeopleSoft instances and internally reachable deployments without network segmentation are both viable targets.

Refer to the Oracle Security Alert July 2026 for authoritative technical detail.

Detection Methods for CVE-2026-61073

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to PeopleSoft Purchasing endpoints from unexpected source IPs
Anomalous response sizes from PeopleSoft URLs, indicating bulk data return without a preceding authentication flow
Web server logs showing repeated access to FIN Common Objects Brazil URIs without corresponding session establishment events
Outbound data transfers from PeopleSoft application tiers to unknown destinations

Detection Strategies

Baseline normal request patterns to PeopleSoft Purchasing URIs and alert on requests lacking authenticated session tokens
Deploy web application firewall rules that require authenticated sessions before serving Purchasing responses
Correlate PeopleSoft access logs with identity provider logs to identify requests with no matching authentication event
Hunt historical HTTP logs for access patterns targeting FIN Common Objects Brazil endpoints prior to patching

Monitoring Recommendations

Forward PeopleSoft web server, application server, and database audit logs to a centralized analytics platform for retention and querying
Monitor for spikes in read-heavy queries against Purchasing tables
Alert on any 200-status HTTP responses to Purchasing endpoints originating from anonymous sessions
Track egress traffic volume from PeopleSoft hosts to detect potential bulk exfiltration

How to Mitigate CVE-2026-61073

Immediate Actions Required

Apply the fixes contained in the Oracle Critical Patch Update - July 2026 to all affected PeopleSoft Enterprise FIN Common Objects Brazil 9.1 instances
Inventory PeopleSoft deployments and confirm which host the FIN Common Objects Brazil Purchasing component
Restrict network access to PeopleSoft HTTP interfaces to trusted management networks and authorized users until patching is complete
Review PeopleSoft web and application logs for prior unauthenticated access to Purchasing endpoints

Patch Information

Oracle released the fix as part of the July 2026 Critical Patch Update. Administrators should follow Oracle's documented patching procedure for PeopleSoft, including validation in non-production environments, application of the CPU bundle, and post-patch verification of module functionality. The full advisory is available in the Oracle Security Alert July 2026.

Workarounds

Place vulnerable PeopleSoft instances behind a reverse proxy or WAF that enforces authentication before requests reach the application server
Apply network access control lists to permit HTTP access only from trusted internal segments and VPN ranges
Disable or block routes to the Purchasing component if it is not required for business operations until the patch is applied
Increase log retention and monitoring on affected hosts during the patching window

bash

# Example: restrict PeopleSoft HTTP access to a trusted CIDR using iptables
iptables -A INPUT -p tcp --dport 8000 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP