CVE-2026-61204

Analyzed Analyzed - Analysis Complete

PeopleSoft Enterprise FIN Program Management Remote Code Execution

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Oracle

Description

Vulnerability in the PeopleSoft Enterprise FIN Program Management product of Oracle PeopleSoft (component: Primavera Integration). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Program Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise FIN Program Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Program Management. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-61204

EUVD

EUVD-2026-47408

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	peoplesoft_enterprise_fin_program_management	9.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle PeopleSoft Enterprise FIN Program Management version 9.2. It allows a low-privileged attacker with network access via HTTP to potentially take over the system. The attack requires human interaction from someone other than the attacker and may impact other connected products.

Detection Guidance

Detection of CVE-2026-61204 requires monitoring for unauthorized access attempts to the PeopleSoft Enterprise FIN Program Management component via HTTP. Check web server logs for unusual activity targeting the Primavera Integration module. Ensure all PeopleSoft Enterprise FIN Program Management instances are updated to version 9.2 or later.

Impact Analysis

If exploited, an attacker could gain full control over the PeopleSoft Enterprise FIN Program Management system. This could lead to unauthorized access, data theft, or disruption of services. The high CVSS score indicates significant potential for confidentiality, integrity, and availability impacts.

Compliance Impact

This vulnerability allows low-privileged attackers to compromise PeopleSoft Enterprise FIN Program Management via HTTP, potentially leading to full system takeover. Such unauthorized access could result in unauthorized disclosure, alteration, or destruction of sensitive data, which may violate GDPR (data protection) and HIPAA (health information privacy) requirements for confidentiality, integrity, and availability.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for PeopleSoft Enterprise FIN Program Management version 9.2 to address the vulnerability. Ensure network access controls restrict HTTP access to only trusted sources and limit privileges for users interacting with the system.

Hi! I’m here to help you understand CVE-2026-61204. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70