This vulnerability affects Oracle PeopleSoft Enterprise FIN Common Objects Brazil, specifically version 9.1. It permits an unauthenticated attacker with network access over HTTP to compromise the product, potentially leading to unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates that the attack can be performed remotely with low complexity, no privileges, and no user interaction, resulting in a high confidentiality impact without affecting integrity or availability. The vendor advisory is a general Critical Patch Update notice listing many products and versions but does not explicitly state a patch or fix for this vulnerability. Patch status is therefore not confirmed and should be verified by consulting the vendor advisory directly.

Successful exploitation allows an unauthenticated remote attacker to gain unauthorized access to critical or all accessible data within PeopleSoft Enterprise FIN Common Objects Brazil version 9.1. This compromises confidentiality but does not impact integrity or availability according to the CVSS vector. The vulnerability poses a high risk of data exposure.

Patch status is not yet confirmed for this specific vulnerability. Oracle’s Critical Patch Update advisory for July 2026 does not explicitly mention a fix for CVE-2026-61236. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply any relevant patches promptly. Until a patch is confirmed and applied, restrict network access to the affected service where possible to reduce exposure.