CVE-2026-71112: High severity Oracle PeopleSoft Enterprise FIN Common Objects vulnerability
Vulnerability in the PeopleSoft Enterprise FIN Common Objects product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Common Objects. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle PeopleSoft Enterprise FIN Common Objects (component: Security)to a version that resolves this vulnerability.Fixed in 9.2
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
Prioritize Oracle PeopleSoft Enterprise FIN Common Objects version 9.2 instances whose Security component is reachable over HTTP from an attacker's network location. The vulnerability is network-accessible and does not require prior authentication.
What does an attacker need to exploit this issue?
An attacker needs network access via HTTP. No privileges or user interaction are required, but the vulnerability is rated difficult to exploit with high attack complexity.
What is the potential impact of a successful attack?
Successful exploitation can result in takeover of PeopleSoft Enterprise FIN Common Objects. Confidentiality, integrity, and availability impacts are all rated high.