Description

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Common Objects). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker with network access via T3, IIOP to compromise PeopleSoft Enterprise FIN Common Objects Brazil. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Common Objects Brazil. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-18T21:17:42.243Z",
  "pubdate": "2026-08-18T21:17:42.243Z",
  "executiveSummary": "An easily exploitable vulnerability affects the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft, specifically within the Common Objects component in version 9.1.\nThe vulnerability allows a high-privileged attacker with network access to compromise the targeted system, resulting in the complete takeover of the PeopleSoft Enterprise FIN Common Objects Brazil application.\nThe CVSS 3.1 base score is 7.2, reflecting high impacts on confidentiality, integrity, and availability.\nRisk implications include unauthorized access to sensitive financial data, modification of critical system and business records, and disruption of operational services.\nExploitation requires network access using specific protocols such as T3 or IIOP, along with high privileges on the affected application.",
  "technicalDetails": "The vulnerability resides within the Common Objects component of PeopleSoft Enterprise FIN Common Objects Brazil version 9.1.\nThe attack vector is network-based (AV:N), utilizing enterprise middleware communication protocols including T3 and IIOP to reach the vulnerable service.\nAttack complexity is rated as low (AC:L), indicating that successful exploitation does not require highly specialized conditions beyond protocol access and valid credentials.\nThe attack requires high privileges (PR:H), meaning the adversary must already possess authenticated administrative or high-level access within the PeopleSoft environment to interact with the vulnerable component.\nUser interaction is not required (UI:N), allowing the attack to be executed programmatically by a malicious actor.\nThe step-by-step attack flow begins with the attacker establishing network connectivity to the PeopleSoft environment utilizing the T3 or IIOP protocols exposed by the application server.\nLeveraging their high-privileged access, the attacker submits crafted requests or payloads designed to interact with the vulnerable Common Objects component.\nDue to insufficient validation or improper access controls within the targeted component, the input is processed improperly, allowing the attacker to bypass security boundaries.\nSuccessful exploitation results in full application takeover, granting the attacker the ability to execute arbitrary actions, manipulate data, and compromise the confidentiality, integrity, and availability (C:H/I:H/A:H) of the PeopleSoft Enterprise FIN Common Objects Brazil instance."
}