CVE-2026-61056

Vulnerability in the PeopleSoft Enterprise FIN Grants product of Oracle PeopleSoft (component: Grants). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Grants. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Grants accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Grants accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.oracle.com/security-alerts/cpujul2026.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:oracle:peoplesoft_enterprise_fin_grants:9.2:*:*:*:*:*:*:*

History

24 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad en el producto PeopleSoft Enterprise FIN Grants de Oracle PeopleSoft (componente: Grants). La versión compatible afectada es la 9.2. Una vulnerabilidad difícil de explotar permite a un atacante no autenticado con acceso de red a través de HTTP comprometer PeopleSoft Enterprise FIN Grants. Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado de actualización, inserción o eliminación a algunos de los datos accesibles de PeopleSoft Enterprise FIN Grants, así como acceso de lectura no autorizado a un subconjunto de los datos accesibles de PeopleSoft Enterprise FIN Grants. Puntuación Base CVSS 3.1 4.8 (impactos en la Confidencialidad e Integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

Information

Published : 2026-07-21 22:18

Updated : 2026-10-24 15:10

NVD link : CVE-2026-61056

Mitre link : CVE-2026-61056

CVE.ORG link : CVE-2026-61056

JSON object : View

Products Affected

oracle

peoplesoft_enterprise_fin_grants

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-61056", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61056", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-24T14:32:01.180991Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert_us@oracle.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}]}, "affected": [{"source": "secalert_us@oracle.com", "affectedData": [{"vendor": "Oracle Corporation", "product": "PeopleSoft Enterprise FIN Grants", "versions": [{"status": "affected", "version": "9.2", "versionType": "semver"}]}]}], "published": "2026-07-21T22:18:36.407", "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2026.html", "tags": ["Vendor Advisory"], "source": "secalert_us@oracle.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Vulnerability in the PeopleSoft Enterprise FIN Grants product of Oracle PeopleSoft (component: Grants). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Grants. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Grants accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Grants accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."}, {"lang": "es", "value": "Vulnerabilidad en el producto PeopleSoft Enterprise FIN Grants de Oracle PeopleSoft (componente: Grants). La versi\u00f3n compatible afectada es la 9.2. Una vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con acceso de red a trav\u00e9s de HTTP comprometer PeopleSoft Enterprise FIN Grants. Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado de actualizaci\u00f3n, inserci\u00f3n o eliminaci\u00f3n a algunos de los datos accesibles de PeopleSoft Enterprise FIN Grants, as\u00ed como acceso de lectura no autorizado a un subconjunto de los datos accesibles de PeopleSoft Enterprise FIN Grants. Puntuaci\u00f3n Base CVSS 3.1 4.8 (impactos en la Confidencialidad e Integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."}], "lastModified": "2026-10-24T15:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_fin_grants:9.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC174779-EA54-45F4-85F3-07CE09BF92ED"}], "operator": "OR"}]}], "sourceIdentifier": "secalert_us@oracle.com"}