Description

Vulnerability in the PeopleSoft Enterprise FIN Common Objects product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Common Objects. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T21:18:11.753Z",
  "pubdate": "2026-08-18T21:18:11.753Z",
  "executiveSummary": "A severe vulnerability exists within the Security component of the Oracle PeopleSoft Enterprise FIN Common Objects product, specifically affecting version 9.2. This vulnerability introduces a significant risk to organizational infrastructure by allowing unauthenticated remote threat actors to achieve full system compromise through network-based vectors over HTTP.\nThe flaw carries a CVSS 3.1 Base Score of 8.1, reflecting high impacts across confidentiality, integrity, and availability. While the attack complexity is rated as high, successful exploitation requires no user interaction and no prior privileges, meaning an external adversary with network connectivity can directly target the exposed service.\nThe primary risk implication of this vulnerability is the complete takeover of the PeopleSoft Enterprise FIN Common Objects component. Because financial systems handle highly sensitive organizational data, an unauthorized systemic takeover can lead to severe data breaches, malicious manipulation of financial records, and operational downtime.\nOrganizations utilizing the affected Oracle PeopleSoft version must prioritize defensive remediation strategies. Given the severity of a potential system takeover, immediate administrative intervention is required to secure the attack surface and apply vendor-supplied updates as soon as they are made available.",
  "technicalDetails": "The vulnerability resides in the Security component of Oracle PeopleSoft Enterprise FIN Common Objects version 9.2, exposing administrative or operational logic to unauthenticated network interactions.\nExploitation of this vulnerability occurs via the HTTP protocol, indicating that the vulnerable component exposes an improperly secured web interface, endpoint, or API that fails to adequately validate client authenticity before processing sensitive requests.\nThe attack vector is strictly network-based (AV:N), meaning no local access or physical presence is required. Furthermore, the vulnerability requires zero privileges (PR:N) and no user interaction (UI:N), enabling autonomous remote exploitation by any entity capable of routing HTTP traffic to the target instance.\nAlthough the CVSS assessment designates the attack complexity as high (AC:H), indicating that successful exploitation may depend on specific timing, race conditions, precise parameter crafting, or environmental prerequisites, the ultimate payoff for a successful attack is absolute.\nThe step-by-step attack flow begins with the adversary performing reconnaissance over the network to identify the exposed PeopleSoft Enterprise FIN Common Objects HTTP interface. Following target identification, the attacker crafts a specialized HTTP request designed to bypass or subvert the security controls implemented within the Security component.\nUpon receipt of the malicious payload, the vulnerable component improperly parses or authorizes the input, allowing the attacker to execute unauthorized administrative actions or inject arbitrary execution flows.\nPost-exploitation impact encompasses a complete system takeover (S:U/C:H/I:H/A:H). An attacker who successfully exploits this vulnerability gains total control over the affected FIN Common Objects component, permitting full read, write, and execute capabilities over sensitive financial data, underlying system files, and connected administrative workflows."
}