This vulnerability affects Oracle PeopleSoft Enterprise FIN Staffing Front Office Brazil, version 9.1. It is easily exploitable by an attacker with low privileges and network access over HTTP, allowing compromise and potential takeover of the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impacts on confidentiality, integrity, and availability. The vulnerability may also impact other Oracle products beyond the initial scope. Oracle's July 2026 Critical Patch Update advisory references many patches but does not explicitly confirm a fix for this CVE. Customers are strongly advised to review the advisory and apply patches promptly if available.

Successful exploitation can lead to complete takeover of the PeopleSoft Enterprise FIN Staffing Front Office Brazil product, compromising confidentiality, integrity, and availability. The vulnerability is network accessible and requires only low privileges, making it highly critical. Additionally, the attack may have broader impact on other Oracle products due to scope change.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. However, the advisory content provided does not explicitly confirm a patch or fix for CVE-2026-61072. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, organizations should consider restricting network access to the affected product and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.