CVE-2026-61074: Oracle PeopleSoft RCE Vulnerability

CVE-2026-61074 Overview

CVE-2026-61074 affects the Oracle PeopleSoft Enterprise FIN Common Objects Brazil product, specifically the eProcurement component. The vulnerability impacts version 9.1 and allows an unauthenticated attacker with network access via HTTP to compromise the affected product. Successful exploitation can result in a full takeover of PeopleSoft Enterprise FIN Common Objects Brazil, affecting confidentiality, integrity, and availability. Oracle addressed this issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can achieve complete takeover of the PeopleSoft Enterprise FIN Common Objects Brazil product over HTTP, though exploitation is rated as high complexity.

Affected Products

Oracle PeopleSoft Enterprise FIN Common Objects Brazil, version 9.1
Component: eProcurement
Deployments exposing the PeopleSoft HTTP interface to untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-61074 published to NVD as part of the Oracle July 2026 Critical Patch Update
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-61074

Vulnerability Analysis

The flaw resides in the eProcurement component of Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1. An unauthenticated attacker can reach the vulnerable code path over HTTP without any user interaction. Oracle classifies exploitation as difficult, indicating that specific conditions or preparatory steps are required to reliably trigger the issue.

Successful attacks yield takeover of the affected PeopleSoft product. This means adversaries can read sensitive financial data, alter procurement records, and disrupt service availability. The impact scope remains unchanged, so compromise is confined to the vulnerable component and any resources it controls.

Root Cause

Oracle has not published the underlying weakness class or CWE mapping for CVE-2026-61074. The advisory only confirms that the eProcurement component fails to adequately restrict actions exposed to unauthenticated network callers. Refer to the Oracle Critical Patch Update July 2026 for the vendor's technical acknowledgement.

Attack Vector

The attack originates from the network and travels over HTTP to the PeopleSoft application server. No credentials or user interaction are required. An attacker who can reach the eProcurement endpoint from an untrusted network segment can attempt exploitation directly against the exposed interface.

No public proof-of-concept, exploit code, or in-the-wild activity has been reported. The EPSS probability sits at 0.376%, reflecting low current exploitation likelihood, but the exposure remains significant for internet-facing deployments.

Detection Methods for CVE-2026-61074

Indicators of Compromise

Unexpected HTTP requests to eProcurement endpoints from external or unusual source addresses
Anomalous authentication or session activity in PeopleSoft audit logs following unauthenticated HTTP traffic
Unplanned changes to procurement records, supplier data, or workflow definitions in PeopleSoft Financials
Outbound network connections initiated by the PeopleSoft application server to unfamiliar hosts

Detection Strategies

Baseline normal HTTP traffic to PeopleSoft eProcurement URLs and alert on requests from non-corporate ranges
Correlate web server access logs with PeopleSoft application logs to surface unauthenticated requests that trigger privileged operations
Deploy signatures on web application firewalls that flag malformed or oversized parameters submitted to eProcurement endpoints

Monitoring Recommendations

Enable verbose logging on the PeopleSoft web and application tiers, then forward logs to a central analytics platform
Monitor privileged account creation, role changes, and configuration edits within PeopleSoft after the CPU release date
Track process execution and file writes on PeopleSoft servers to detect post-exploitation persistence attempts

How to Mitigate CVE-2026-61074

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to PeopleSoft Enterprise FIN Common Objects Brazil 9.1 without delay
Inventory all PeopleSoft deployments, including test and disaster recovery instances, and confirm patch status
Restrict HTTP access to eProcurement interfaces so only trusted networks and VPN users can reach them
Review recent PeopleSoft logs for signs of unauthenticated exploitation attempts against eProcurement endpoints

Patch Information

Oracle released the fix in the July 2026 Critical Patch Update. Administrators should follow Oracle's guidance in the Oracle Critical Patch Update July 2026 advisory to identify the specific patch bundle for PeopleSoft Enterprise FIN Common Objects Brazil 9.1 and validate installation in a staging environment before production rollout.

Workarounds

Place PeopleSoft eProcurement behind a reverse proxy or web application firewall that enforces strict request validation
Limit exposure of the eProcurement component to internal networks until the CPU patch is deployed
Enforce network segmentation so that the PeopleSoft application tier cannot be reached directly from the internet
Increase log retention and alerting sensitivity on PeopleSoft components during the exposure window

bash

# Example: restrict access to PeopleSoft eProcurement at the reverse proxy layer
# Replace 10.0.0.0/8 with your trusted internal ranges
location /psc/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://peoplesoft-app-tier;
}