CVE-2026-61236: PeopleSoft FIN Auth Bypass Vulnerability

CVE-2026-61236 Overview

CVE-2026-61236 affects the Oracle PeopleSoft Enterprise FIN Common Objects Brazil product, specifically the Staffing component in version 9.1. The flaw allows an unauthenticated attacker with network access via HTTP to compromise the application. Successful exploitation grants unauthorized read access to critical data, potentially exposing all data accessible to the affected module. The weakness is classified under [CWE-284] Improper Access Control. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Remote, unauthenticated attackers can retrieve sensitive data from PeopleSoft Enterprise FIN Common Objects Brazil deployments over HTTP without user interaction.

Affected Products

Oracle PeopleSoft Enterprise FIN Common Objects Brazil, version 9.1
Component: Staffing
Deployments exposing the PeopleSoft HTTP interface to untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-61236 published to NVD
2026-07-22 - Last updated in NVD database
Oracle disclosed the issue in the Oracle Security Alert July 2026

Technical Details for CVE-2026-61236

Vulnerability Analysis

The vulnerability resides in the Staffing component of PeopleSoft Enterprise FIN Common Objects Brazil 9.1. It is an access control weakness that permits unauthenticated HTTP requests to reach and return protected data. The attack vector is the network, complexity is low, and no privileges or user interaction are required. Impact is scoped to confidentiality, with no direct effect on integrity or availability. The EPSS score sits at 0.287% (percentile 20.809), indicating current exploitation prediction is low.

Root Cause

The root cause is improper access control [CWE-284] in the Staffing component. Authorization checks are either missing or insufficient on request paths that expose data accessible to the FIN Common Objects Brazil module. As a result, requests that should require authenticated sessions succeed without valid credentials.

Attack Vector

An attacker sends crafted HTTP requests to the exposed PeopleSoft endpoint from any network-reachable position. Because no authentication is enforced, the server returns data governed by the vulnerable component. Oracle did not publish exploitation details, and no public proof-of-concept has been released. Refer to the Oracle Security Alert July 2026 for vendor-provided technical context.

Detection Methods for CVE-2026-61236

Indicators of Compromise

Unauthenticated HTTP requests to PeopleSoft Staffing URLs returning data payloads with HTTP 200 status codes
Anomalous outbound data volumes from PeopleSoft application servers to external IP addresses
Access log entries missing session identifiers on endpoints that normally require authentication

Detection Strategies

Review PeopleSoft web server and application logs for requests to Staffing component paths lacking authenticated session cookies
Baseline normal HTTP traffic to the PeopleSoft Enterprise FIN Common Objects Brazil module and alert on deviations
Correlate web application firewall (WAF) telemetry with backend query volume to identify enumeration patterns

Monitoring Recommendations

Enable verbose access logging on all PeopleSoft HTTP endpoints and forward logs to a centralized SIEM
Alert on repeated requests from single source IPs targeting Staffing URLs
Monitor database query rates originating from the FIN Common Objects Brazil service for unexpected spikes

How to Mitigate CVE-2026-61236

Immediate Actions Required

Apply the fixes from the Oracle July 2026 Critical Patch Update to all PeopleSoft Enterprise 9.1 environments
Inventory internet-exposed PeopleSoft instances and remove direct public exposure where possible
Restrict HTTP access to the Staffing component to authenticated users on trusted network segments

Patch Information

Oracle released the fix in the July 2026 Critical Patch Update. Administrators should review the Oracle Security Alert July 2026 advisory for the exact patch identifiers, prerequisites, and installation instructions for PeopleSoft Enterprise 9.1.

Workarounds

Place the PeopleSoft application behind a reverse proxy or WAF that enforces authentication before requests reach the Staffing component
Apply network access control lists (ACLs) restricting HTTP access to known corporate ranges and VPN gateways
Disable or restrict the Staffing component if it is not required for business operations until the patch is applied

bash

# Example: restrict inbound HTTP to PeopleSoft to trusted subnets via iptables
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP