This vulnerability affects Oracle PeopleSoft Enterprise FIN Payables version 9.2 and permits unauthenticated remote attackers to compromise the system via HTTP network access. The attack can lead to unauthorized disclosure of critical or complete accessible data within the PeopleSoft FIN Payables environment. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact without integrity or availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for it. Customers are advised to consult the advisory for patch details and apply updates promptly.

Successful exploitation results in unauthorized access to sensitive or all accessible data in PeopleSoft Enterprise FIN Payables 9.2. There is no impact on data integrity or availability. The vulnerability can be exploited remotely without authentication or user interaction, posing a significant confidentiality risk.

Oracle's July 2026 Critical Patch Update advisory includes security patches for multiple products, including PeopleSoft. However, the advisory does not explicitly confirm a patch or remediation for CVE-2026-61087. Customers should review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply any relevant updates without delay. Until a patch is applied, restricting network access to the PeopleSoft FIN Payables HTTP interface from untrusted sources may reduce exposure.