CVE-2026-61245: PeopleSoft Enterprise Auth Bypass Flaw

CVE-2026-61245 Overview

CVE-2026-61245 is an improper access control vulnerability [CWE-284] in the Integration component of Oracle PeopleSoft Enterprise FIN Manufacturing Brazil version 9.1. An unauthenticated remote attacker with network access via HTTPS can exploit the flaw to take over the affected product. The vulnerability requires no user interaction and no privileges, making it trivially exploitable across exposed deployments. Oracle addressed the issue in the July 2026 Critical Patch Update. The flaw impacts confidentiality, integrity, and availability of the target system.

Critical Impact
An unauthenticated network attacker can achieve full takeover of PeopleSoft Enterprise FIN Manufacturing Brazil over HTTPS, compromising all financial and manufacturing data processed by the module.

Affected Products

Oracle PeopleSoft Enterprise FIN Manufacturing Brazil 9.1
Integration component of the PeopleSoft Enterprise FIN suite
Deployments exposing the Integration endpoint over HTTPS

Discovery Timeline

2026-07-21 - CVE-2026-61245 published to NVD
2026-07-22 - Last updated in NVD database
July 2026 - Oracle releases fix as part of the Critical Patch Update

Technical Details for CVE-2026-61245

Vulnerability Analysis

The Integration component of PeopleSoft Enterprise FIN Manufacturing Brazil fails to enforce proper access controls on network-reachable functionality. An attacker sending crafted HTTPS requests can invoke restricted actions without authenticating. Successful exploitation results in full compromise of the module, including read and write access to manufacturing and financial records.

Because the affected component handles integration traffic between PeopleSoft and external systems, the vulnerability sits directly on the network attack surface. Perimeter placement combined with the lack of authentication makes internet-exposed instances particularly attractive to opportunistic scanners.

The EPSS probability is 0.358% as of 2026-07-22, indicating limited observed exploitation activity at publication. However, PeopleSoft financial modules are historically high-value targets, and this posture can shift rapidly once proof-of-concept code circulates.

Root Cause

The defect is classified under CWE-284 (Improper Access Control). The Integration component does not correctly validate the caller's authorization state before executing privileged operations. Access decisions rely on assumptions that an attacker can bypass by directly reaching the exposed HTTPS endpoint.

Attack Vector

Exploitation occurs over the network via HTTPS. The attacker requires no credentials, no prior foothold, and no user interaction. Any host that can reach the PeopleSoft Integration listener can attempt the attack, including from the public internet where the service is exposed through reverse proxies or load balancers.

Oracle has not released public technical details of the exploitation path. See the Oracle Critical Patch Update July 2026 advisory for vendor guidance.

Detection Methods for CVE-2026-61245

Indicators of Compromise

Unauthenticated HTTPS requests to PeopleSoft Integration Broker endpoints from unexpected source addresses
New or modified integration gateway configurations, service operations, or routings without a corresponding change record
Anomalous outbound connections initiated by the PeopleSoft application server following inbound Integration traffic
Creation of new administrative users or role assignments in the PeopleSoft security tables

Detection Strategies

Review Integration Broker access logs for requests to service operations without a valid authentication token
Correlate web tier (WebLogic/Tuxedo) access logs against application-tier authentication events to identify bypass patterns
Baseline normal integration partners and alert on inbound HTTPS from previously unseen IP ranges
Monitor PeopleSoft audit tables for unauthorized DDL or configuration changes

Monitoring Recommendations

Enable verbose logging on the Integration Broker and forward logs to a centralized SIEM for correlation
Alert on repeated HTTP 4xx responses on Integration endpoints, which may indicate reconnaissance preceding exploitation
Track process creation and file writes on PeopleSoft application servers using an EDR agent
Monitor egress traffic from PeopleSoft servers for signs of data staging or command-and-control activity

How to Mitigate CVE-2026-61245

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all PeopleSoft Enterprise FIN Manufacturing Brazil 9.1 deployments
Inventory all internet-exposed PeopleSoft Integration Broker endpoints and remove unnecessary exposure
Rotate credentials, integration keys, and service account passwords used by the affected component
Review Integration Broker configuration for unauthorized service operations or routings added since July 2026

Patch Information

Oracle addressed CVE-2026-61245 in the July 2026 Critical Patch Update. Administrators should follow the patch application procedure documented in the Oracle Critical Patch Update July 2026 advisory and validate the patch level in PSSTATUS after deployment. Oracle CPU patches are cumulative for a given release, so the July 2026 bundle also delivers prior fixes for the 9.1 code line.

Workarounds

Restrict network access to the Integration Broker so only trusted integration partners can reach the HTTPS endpoint
Place PeopleSoft behind a web application firewall with rules limiting Integration Broker service operations to authenticated callers
Disable unused service operations and routings in the Integration Broker configuration to reduce attack surface
Enforce mutual TLS on integration endpoints where the deployment supports it

bash

# Example: restrict Integration Broker exposure at the network edge
# Allow only trusted partner subnets to reach the PeopleSoft HTTPS listener
iptables -A INPUT -p tcp --dport 443 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP