CVE-2026-61234 affects Oracle PeopleSoft Enterprise FIN Common Objects Brazil (component: eProcurement) version 9.1. It is a network-accessible vulnerability exploitable via HTTP by unauthenticated attackers, with a high complexity barrier. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, or unauthorized access to all data accessible by the product. The CVSS vector indicates no privileges or user interaction required, with high confidentiality and integrity impact and no availability impact. Oracle’s July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a fix for this vulnerability in the provided excerpt. The vulnerability is published and assigned a high severity score of 7.4. No known exploits in the wild have been reported.

An attacker with network access via HTTP can exploit this vulnerability without authentication to gain unauthorized access to critical data or perform unauthorized creation, deletion, or modification of data within PeopleSoft Enterprise FIN Common Objects Brazil version 9.1. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. No known exploits have been observed in the wild so far.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly and staying on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected service to trusted users only and monitor for unusual activity related to PeopleSoft Enterprise FIN Common Objects Brazil.