This vulnerability affects Oracle PeopleSoft Enterprise FIN Common Objects Argentina, specifically version 9.1. It is easily exploitable by an attacker with low privileges who can access the system over HTTP. Successful exploitation can result in complete compromise of the product, affecting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references many patches but does not explicitly confirm a patch for this vulnerability. The product is not a cloud service, so remediation depends on applying vendor patches if available.

The vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise PeopleSoft Enterprise FIN Common Objects Argentina version 9.1. This includes complete loss of confidentiality, integrity, and availability of the affected system, effectively enabling takeover of the product instance.

Oracle's July 2026 Critical Patch Update advisory does not explicitly confirm a patch for CVE-2026-61243. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Customers should remain on actively supported versions and apply security patches promptly once available. No vendor advisory states that no action is required or that the issue is already mitigated.