CVE-2026-61238: PeopleSoft Enterprise Auth Bypass Flaw

CVE-2026-61238 Overview

CVE-2026-61238 is an access control vulnerability in the Oracle PeopleSoft Enterprise FIN Common Objects Argentina product, specifically within the eProcurement component. The affected supported version is 9.1. An unauthenticated attacker with network access via HTTP can exploit this vulnerability to compromise the affected PeopleSoft deployment. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all data accessible by the product. The weakness is classified under [CWE-284] Improper Access Control.

Critical Impact
An unauthenticated remote attacker can read, modify, create, or delete all data accessible to PeopleSoft Enterprise FIN Common Objects Argentina over HTTP.

Affected Products

Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1
Component: eProcurement
Deployments exposing PeopleSoft HTTP endpoints to untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-61238 published to NVD
2026-07-22 - Last updated in NVD database
July 2026 - Addressed in Oracle Security Alert July 2026

Technical Details for CVE-2026-61238

Vulnerability Analysis

The vulnerability exists in the eProcurement component of PeopleSoft Enterprise FIN Common Objects Argentina 9.1. Improper access control [CWE-284] permits an unauthenticated attacker to reach functionality that should require authentication and authorization. The attack is delivered over the network via HTTP, requires no user interaction, and has low complexity, according to Oracle's advisory. Exploitation impacts both confidentiality and integrity of all data reachable by the product. Availability is not directly impacted based on the reported CVSS vector.

EPSS currently scores this issue at 0.303% with a percentile of 22.4, indicating limited observed exploitation activity at publication time. However, unauthenticated network-accessible flaws in enterprise ERP components historically attract post-disclosure scanning and opportunistic exploitation.

Root Cause

The root cause is improper enforcement of access control checks on eProcurement HTTP endpoints within the FIN Common Objects Argentina module. Requests that should be gated by authentication and role-based authorization are accepted and processed. This allows an anonymous requester to invoke data operations reserved for authenticated PeopleSoft users.

Attack Vector

Exploitation requires only network reachability to the PeopleSoft HTTP interface. The attacker sends crafted HTTP requests to the vulnerable eProcurement endpoint without providing credentials. Because no user interaction and no privileges are required, the vulnerability is suitable for automated mass exploitation against internet-exposed PeopleSoft deployments. No public proof-of-concept code is available at this time. Refer to the Oracle Security Alert July 2026 for vendor technical details.

Detection Methods for CVE-2026-61238

Indicators of Compromise

Unauthenticated HTTP requests to eProcurement URLs originating from external or unexpected internal sources
Unexpected create, update, or delete operations on FIN Common Objects Argentina tables outside normal business hours
New or modified procurement records lacking a corresponding authenticated PeopleSoft user session
PeopleSoft web server access logs showing anomalous request patterns targeting eProcurement paths without session cookies

Detection Strategies

Correlate PeopleSoft application server logs with web tier access logs to identify HTTP requests that reached eProcurement handlers without an authenticated session
Baseline normal eProcurement request volumes and alert on statistical deviations
Monitor database audit logs for data modification events on FIN Common Objects Argentina objects that cannot be attributed to a legitimate OPRID

Monitoring Recommendations

Enable and centralize PeopleSoft PIA web server, application server, and database audit logs
Deploy web application firewall rules to log and inspect requests to eProcurement endpoints
Alert on HTTP 200 responses to eProcurement URLs where no authentication headers or session tokens are present

How to Mitigate CVE-2026-61238

Immediate Actions Required

Apply the Oracle Critical Patch Update released in the Oracle Security Alert July 2026 to all affected PeopleSoft 9.1 environments
Restrict network access to PeopleSoft HTTP interfaces to trusted networks and VPN users only
Review audit logs for signs of unauthorized data access or modification since deployment of version 9.1
Rotate any credentials or sensitive data that may have been exposed through the eProcurement component

Patch Information

Oracle addressed CVE-2026-61238 in the July 2026 Critical Patch Update. Administrators should download and apply the PeopleSoft patch bundle referenced in the Oracle Security Alert July 2026. Test the patch in a non-production environment before production rollout to validate integration with existing customizations.

Workarounds

Block external access to the eProcurement URLs at the network perimeter or reverse proxy until patching is complete
Enforce authentication at the web tier using a reverse proxy or WAF that rejects unauthenticated requests to affected endpoints
Disable the eProcurement component in the FIN Common Objects Argentina module if it is not required for business operations

bash

# Example reverse proxy rule to require authentication header on eProcurement paths
location /psc/.*/EPROCUREMENT/ {
    if ($http_cookie !~ "PS_TOKEN=") {
        return 403;
    }
    proxy_pass http://peoplesoft_backend;
}