CVE-2026-61087: Oracle PeopleSoft Auth Bypass Vulnerability

CVE-2026-61087 Overview

CVE-2026-61087 is a high-severity vulnerability in the Oracle PeopleSoft Enterprise FIN Payables product, specifically within the Security component. The flaw affects PeopleSoft Enterprise FIN Payables version 9.2. An unauthenticated attacker with network access via HTTP can exploit this vulnerability without user interaction. Successful exploitation results in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Payables accessible data. Oracle addressed this issue in the July 2026 Critical Patch Update.

Critical Impact
Remote, unauthenticated attackers can access sensitive financial and payables data over HTTP without any user interaction.

Affected Products

Oracle PeopleSoft Enterprise FIN Payables 9.2
Oracle PeopleSoft (Security component)
Deployments exposing PeopleSoft FIN Payables HTTP endpoints to untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-61087 published to NVD
2026-07-21 - Oracle Security Alert (July 2026 Critical Patch Update) references addressed
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-61087

Vulnerability Analysis

The vulnerability resides in the Security component of Oracle PeopleSoft Enterprise FIN Payables 9.2. It is classified as an information disclosure flaw impacting confidentiality only, with no impact to integrity or availability. The attack vector is network-based over HTTP, requires low complexity, no privileges, and no user interaction. This combination makes exploitation straightforward for any attacker capable of reaching the application's HTTP interface. The EPSS score is 0.398% with a percentile of 32.339, indicating a low probability of near-term mass exploitation, though the trivial exploitation profile warrants urgent remediation.

Root Cause

Oracle has not publicly disclosed the specific technical root cause. Based on the CVSS metrics and component classification, the flaw appears to stem from missing or improper access control checks in the Security layer of FIN Payables. Requests that should require authenticated, authorized sessions instead return protected data to anonymous callers. This aligns with a broken access control pattern in the web-facing tier of the PeopleSoft application.

Attack Vector

An attacker sends crafted HTTP requests directly to an exposed PeopleSoft Enterprise FIN Payables endpoint. No credentials, session tokens, or victim interaction are required. The server processes the request and returns sensitive payables data, which may include vendor records, invoice information, banking details, and other financial artifacts stored in the module. Internet-exposed deployments and any deployment reachable from untrusted internal networks are at elevated risk.

No public proof-of-concept exploit is currently available. Refer to the Oracle Security Alert July 2026 for authoritative details.

Detection Methods for CVE-2026-61087

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to PeopleSoft FIN Payables URIs originating from unexpected IP ranges
Anomalous spikes in outbound response sizes from PeopleSoft web servers to external clients
Access log entries showing responses to sensitive payables endpoints without a preceding authentication event
Repeated requests enumerating vendor, invoice, or payment identifiers within short time windows

Detection Strategies

Review PeopleSoft web server access logs for HTTP requests to FIN Payables paths that returned HTTP 200 without an associated authenticated session cookie
Correlate WAF and reverse proxy logs to identify anonymous access patterns targeting /psp/, /psc/, or Payables-specific URIs
Baseline normal traffic to PeopleSoft endpoints and alert on deviations in request volume, source geography, or user-agent strings

Monitoring Recommendations

Ingest PeopleSoft application, web server, and database audit logs into a centralized SIEM for correlation
Enable verbose auditing on the PeopleSoft Security component and monitor for anonymous data access events
Alert on any external source IP successfully retrieving FIN Payables data

How to Mitigate CVE-2026-61087

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all PeopleSoft Enterprise FIN Payables 9.2 environments
Inventory all PeopleSoft FIN Payables deployments and confirm which are reachable from the internet or untrusted networks
Restrict inbound HTTP access to PeopleSoft interfaces to trusted networks and VPN users until patching completes
Review recent access logs for evidence of pre-patch exploitation attempts

Patch Information

Oracle released a fix as part of the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for patch download instructions, applicability matrices, and any prerequisite steps for PeopleSoft Enterprise FIN Payables 9.2.

Workarounds

Place PeopleSoft web tiers behind a web application firewall configured to block unauthenticated requests to sensitive Payables URIs
Enforce network segmentation so FIN Payables endpoints are only reachable from authenticated corporate networks
Disable or restrict any public-facing PeopleSoft services that are not required for business operations

bash

# Example: restrict PeopleSoft FIN Payables endpoints at the reverse proxy (nginx)
location ~* /(psp|psc)/.*/EMPLOYEE/ERP/.*PAYABLES.* {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny  all;
    proxy_pass http://peoplesoft_backend;
}