CVE-2026-61057

MediumCVSS 4.8

Published: 21/07/2026(UTC)Updated: 04/08/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

Vulnerability in PeopleSoft Enterprise FIN eSettlements (version 9.2). Difficult to exploit; an unauthenticated attacker via HTTP can gain unauthorized read and modify access to data.

Risk Assessment

Risk of unauthorized access to financial settlement data, potentially leading to fraud or information disclosure.

Recommendation

Apply the patch from Oracle for PeopleSoft Enterprise FIN eSettlements. Strengthen network access controls.

Other vulnerabilities in PeopleSoft Enterprise FIN eSettlements

CVE-2026-60596Low
In PeopleSoft Enterprise FIN eSettlements version 9.2, an easily exploitable vulnerability in the eSettlements component allows an authenticated attacker with high privileges and local access to gain unauthorized read access to a subset of data.

Original NVD description (English source)

Vulnerability in the PeopleSoft Enterprise FIN eSettlements product of Oracle PeopleSoft (component: eSettlements). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN eSettlements. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN eSettlements accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN eSettlements accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS