Executive brief
A vulnerability exists in Oracle PeopleSoft's financial management software specifically used for Brazilian business operations. An unauthenticated attacker can exploit this flaw over the network to gain unauthorized access to sensitive business data. This could lead to the exposure of critical financial records or staffing information, potentially impacting regulatory compliance and corporate privacy.
Technical details
An information disclosure vulnerability exists in the Staffing component of Oracle PeopleSoft Enterprise FIN Common Objects Brazil version 9.1. The flaw is easily exploitable by an unauthenticated attacker with network access via HTTP. Successful exploitation allows the attacker to bypass confidentiality protections and gain unauthorized access to critical data or all accessible data within the affected component. The vulnerability is tracked as part of the July 2026 Oracle Critical Patch Update, and users are advised to apply the relevant security patches from Oracle.
Affected products
- Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory: Published in Oracle July 2026 Critical Patch Update