Summary
CVE-2026-61236 is a high-severity improper access control vulnerability in the Staffing component of Oracle PeopleSoft Enterprise FIN Common Objects Brazil, version 9.1. With a CVSS v3.1 base score of 7.5 (HIGH), the flaw enables unauthenticated remote attackers to gain unauthorized access to critical financial data over HTTP with no user interaction required. The vulnerability was publicly disclosed as part of Oracle’s July 2026 Critical Patch Update, released on July 21, 2026.
Technical details
- Root cause: Improper access control (CWE-284) in the Staffing component allows requests to reach protected data without any authentication check.
- Trigger conditions: No authentication or user interaction is required; an attacker needs only network-level HTTP access to the affected PeopleSoft instance.
- Attack vector: Remotely exploitable over the network (AV:N), with low attack complexity (AC:L) and no privileges required (PR:N/UI:N).
- Impact: Successful exploitation results in unauthorized access to critical data, or complete access to all data accessible within the PeopleSoft Enterprise FIN Common Objects Brazil application. Only confidentiality is affected; there is no impact to integrity or availability.
Affected software
- Oracle PeopleSoft Enterprise FIN Common Objects Brazil, version 9.1
Severity
CVSS v3.1 base score: 7.5 (HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Mitigation and recommended actions
- Immediate: Apply the Oracle July 2026 Critical Patch Update (CPU), released July 21, 2026, per Oracle’s official advisory.
- If patching cannot be applied immediately: Restrict network access to PeopleSoft instances — ensure they are not directly exposed to the public internet, and enforce least-privilege network controls (e.g., firewall rules, VPN-gating) to limit HTTP access to authorized internal users only.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

