CVE-2026-71112: PeopleSoft Enterprise FIN Auth Bypass Flaw

CVE-2026-71112 Overview

CVE-2026-71112 is a high-severity vulnerability in the Oracle PeopleSoft Enterprise FIN Common Objects product, within the Security component. The flaw affects PeopleSoft version 9.2. An unauthenticated attacker with network access over HTTP can compromise the affected component. Successful exploitation results in full takeover of PeopleSoft Enterprise FIN Common Objects, impacting confidentiality, integrity, and availability. Oracle addressed the issue in its August 2026 Security Alert. The weakness is classified under CWE-284 (Improper Access Control).

Critical Impact
Remote, unauthenticated attackers can take over PeopleSoft Enterprise FIN Common Objects, exposing financial data and workflows to unauthorized modification.

Affected Products

Oracle PeopleSoft Enterprise FIN Common Objects 9.2
Component: Security
Vendor: Oracle

Discovery Timeline

2026-08-18 - CVE-2026-71112 published to NVD
2026-08-20 - Last updated in NVD database
August 2026 - Oracle publishes security alert (cspuaug2026)

Technical Details for CVE-2026-71112

Vulnerability Analysis

The vulnerability resides in the Security component of PeopleSoft Enterprise FIN Common Objects 9.2. It permits an unauthenticated remote attacker to interact with the component over HTTP and gain full control of the module. Because the flaw is mapped to [CWE-284] Improper Access Control, the root issue is that a security-relevant operation does not enforce sufficient authorization checks before granting access. Oracle rates the attack complexity as high, indicating that exploitation requires specific conditions or preparatory steps rather than a single trivial request. Successful attacks yield high impact on confidentiality, integrity, and availability, which corresponds to a component-wide takeover. The EPSS probability is 0.348%, placing exploitation likelihood in the lower percentile at the time of publication.

Root Cause

Oracle's advisory attributes the issue to the Security subcomponent of FIN Common Objects. The [CWE-284] categorization indicates that access-control decisions are absent or inadequate for a network-reachable code path. An attacker who satisfies the required preconditions bypasses the intended authorization boundary and executes privileged operations.

Attack Vector

Exploitation occurs over the network via HTTP without prior authentication and without user interaction. Attackers target internet-exposed or intranet-reachable PeopleSoft FIN Common Objects endpoints. Once the access-control check is bypassed, the attacker can read sensitive financial configuration, alter records, or disrupt service availability.

No public proof-of-concept exploit is available at the time of publication. See the Oracle Security Alert for advisory details.

Detection Methods for CVE-2026-71112

Indicators of Compromise

Unauthenticated HTTP requests to PeopleSoft FIN Common Objects endpoints originating from unexpected external or internal sources.
PeopleSoft application logs showing privileged actions in the Security component without a corresponding authenticated session.
Unexpected changes to FIN Common Objects configuration, roles, or permission definitions.

Detection Strategies

Review PeopleSoft web server and application server logs for anomalous access patterns against Security component URLs.
Correlate HTTP access logs with authentication events to identify actions performed without a valid session token.
Baseline normal administrative activity in FIN Common Objects and alert on deviations such as off-hours privilege changes.

Monitoring Recommendations

Forward PeopleSoft web tier, application server, and database audit logs to a centralized analytics platform for retention and correlation.
Monitor egress traffic from PeopleSoft servers for indicators of post-exploitation command-and-control activity.
Track file integrity on PeopleSoft configuration directories and alert on unauthorized modifications.

How to Mitigate CVE-2026-71112

Immediate Actions Required

Apply the fixes referenced in the Oracle Critical Patch Update and Security Alert - August 2026 to all PeopleSoft 9.2 environments.
Inventory internet-exposed PeopleSoft instances and remove direct public access where business requirements permit.
Rotate credentials and review privileged role assignments in FIN Common Objects after patching.

Patch Information

Oracle addressed CVE-2026-71112 in the August 2026 Security Alert. Administrators should download the fixes from My Oracle Support and apply them following Oracle's PeopleSoft patch installation procedures. Validate the patch level of the FIN Common Objects module after deployment.

Workarounds

Restrict HTTP access to PeopleSoft FIN Common Objects endpoints using network ACLs, reverse proxies, or web application firewall rules until patches are applied.
Require VPN or zero-trust network access for administrative and user access to PeopleSoft interfaces.
Enable enhanced logging on the PeopleSoft web tier to increase visibility during the mitigation window.

bash

# Example WAF/reverse proxy rule concept to restrict FIN Common Objects paths
# Replace <trusted_cidr> with authorized source ranges and <psft_host> with your PeopleSoft hostname
location /psp/ {
    allow <trusted_cidr>;
    deny all;
    proxy_pass https://<psft_host>;
}