Description
Vulnerability in the PeopleSoft Enterprise FIN Expenses product of Oracle PeopleSoft (component: Expenses). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Expenses. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Expenses accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Expenses accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Expenses. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L).
Published: 2026-07-21
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw in PeopleSoft Enterprise FIN Expenses (v9.2) permits an unauthenticated attacker to create, delete, or modify critical data and gain full read access, and to trigger a partial denial of service. The weakness involves missing authentication, incorrect access control, and inadequate privilege checks, corresponding to CWEs 269, 284, and 306.

Affected Systems

Oracle Corporation PeopleSoft Enterprise FIN Expenses, supported version 9.2, is the only release listed as impacted.

Risk and Exploitability

The CVSS score of 9.4 indicates high severity across confidentiality, integrity, and availability. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not catalogued in CISA’s KEV list. Attackers can reach the vulnerable endpoint over HTTP from any network host that can access the application, with no authentication required, making the attack vector relatively open and easily exploitable.

Generated by OpenCVE AI on August 4, 2026 at 01:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Oracle’s PeopleSoft Enterprise FIN Expenses 9.2 security patch
  • Restrict network access to the PeopleSoft application using firewall rules or VPN
  • Enforce strong authentication and least‑privilege policies on the application
  • Enable monitoring and logging of authentication and data‑modification events

Generated by OpenCVE AI on August 4, 2026 at 01:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Web Vulnerability Allowing Data Manipulation and Partial Denial in PeopleSoft Enterprise FIN Expenses

Tue, 28 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit Enables Data Modification and Partial DOS in Oracle PeopleSoft FIN Expenses

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit Enables Data Modification and Partial DOS in Oracle PeopleSoft FIN Expenses

Wed, 22 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
CWE-284
CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise FIN Expenses product of Oracle PeopleSoft (component: Expenses). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Expenses. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Expenses accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Expenses accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Expenses. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L).
First Time appeared Oracle
Oracle peoplesoft Enterprise Fin Expenses
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_fin_expenses:9.2:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Fin Expenses
References
Metrics cvssV3_1

{'score': 9.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L'}

Subscriptions

Oracle Peoplesoft Enterprise Fin Expenses
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-22T19:26:27.580Z

Reserved: 2026-07-08T15:52:20.740Z

Link: CVE-2026-61203

cve-icon Vulnrichment

Updated: 2026-07-22T19:26:23.902Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T01:30:04Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control

  • CWE-306

    Missing Authentication for Critical Function