CVE-2025-61758: Oracle PeopleSoft Enterprise FIN IT Asset Management · Improper Access Control
Affects Oracle PeopleSoft Enterprise FIN IT Asset ManagementSource CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 08:30 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 26% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 21 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Mavencom.oracle.peoplesoft/fin-it-asset-managementpkg:maven/com.oracle.peoplesoft/fin-it-asset-managementOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
1. Restrict network access to PeopleSoft FIN IT Asset Management interfaces to trusted internal networks or VPNs, minimizing exposure to untrusted networks. 2. Monitor network traffic and application logs for unusual access patterns or unauthorized data queries indicative of exploitation attempts. 3. Implement strict role-based access controls within PeopleSoft to limit privileges to the minimum necessary, reducing the impact of compromised low-privilege accounts. 4. Apply Oracle security patches promptly once released for this vulnerability. 5. Use web application firewalls (WAFs) to detect and block suspicious HTTP requests targeting PeopleSoft endpoints. 6. Conduct regular security assessments and penetration tests focused on PeopleSoft applications to identify and remediate access control weaknesses. 7. Educate IT and security teams about this vulnerability to ensure rapid response and mitigation. 8. Consider network segmentation to isolate PeopleSoft systems from broader enterprise networks.
Description
Vulnerability in the PeopleSoft Enterprise FIN IT Asset Management product of Oracle PeopleSoft (component: IT Asset Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN IT Asset Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN IT Asset Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).