CVE-2026-61203
Oracle PeopleSoft Enterprise FIN Expenses version 9.2 is affected by a critical flaw that lets an unauthenticated attacker use HTTP to create, delete, or modify data and cause a partial denial of service. The vulnerability can be exploited from the network without any user interaction.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle PeopleSoft Enterprise FIN Expenses 9.2 users, typically organizations that rely on PeopleSoft for financial expense management.
Real-world impact
An attacker could alter or delete critical expense records, create fraudulent entries, and disrupt the availability of the expense system, potentially leading to financial loss and compliance issues.
Why this severity
The CVSS score of 9.4 reflects the high confidentiality and integrity impact (C:H, I:H) combined with a low attack complexity and no authentication required, while the availability impact is only partial (A:L).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources