cve-2026-61056
MEDIUM CVSS 4.8 opencve
Description
Vulnerability in the PeopleSoft Enterprise FIN Grants product of Oracle PeopleSoft (component: Grants). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Grants. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Grants accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Grants accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Timeline
- Published
- 2026-07-21 22:18 UTC
- Last Modified
- 2026-08-04
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
CVSS metrics
| Version | Base | Severity | Vector | Exploitability | Impact | Source |
|---|---|---|---|---|---|---|
| 3.1 | 4.8 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
mitre | ||
| 3.1 | 4.8 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
nvd | ||
| 3.1 | 4.8 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
opencve |
References
No references available.
Linked Vulnerabilities
{
"cve": "CVE-2026-61056",
"enrichment": {
"affected": [
{
"configurations": [
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "generic",
"value": "9.2"
}
}
],
"enrichment": {
"confidence": 95.0,
"confidence_source": "inferred",
"scores": [
{
"score": 95.0,
"source": "inferred"
},
{
"score": 100.0,
"source": "matching"
}
]
},
"original": {
"product": "PeopleSoft Enterprise FIN Grants",
"source": "cna",
"vendor": "Oracle Corporation"
},
"product": "peoplesoft_enterprise_fin_grants",
"vendor": "oracle"
}
],
"created": "2026-07-22T21:00:18.776115+00:00",
"updated": "2026-08-04T02:15:04.190165+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$peoplesoft_enterprise_fin_grants"
]
},
"epss": {
"score": 0.00222
},
"mitre": {
"cpes": [
"cpe:2.3:a:oracle:peoplesoft_enterprise_fin_grants:9.2:*:*:*:*:*:*:*"
],
"created": "2026-07-21T21:37:54.192000+00:00",
"description": "Vulnerability in the PeopleSoft Enterprise FIN Grants product of Oracle PeopleSoft (component: Grants). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Grants. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Grants accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Grants accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 4.8,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"cvssV4_0": {}
},
"mitre_repo_path": "cves/2026/61xxx/CVE-2026-61056.json",
"references": [
"https://www.oracle.com/security-alerts/cpujul2026.html"
],
"title": null,
"updated": "2026-07-24T14:32:25.845000+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$peoplesoft_enterprise_fin_grants"
],
"weaknesses": []
},
"nvd": {
"cpes": [
"cpe:2.3:a:oracle:peoplesoft_enterprise_fin_grants:9.2:*:*:*:*:*:*:*"
],
"created": "2026-07-21T22:18:36.407000+00:00",
"description": "Vulnerability in the PeopleSoft Enterprise FIN Grants product of Oracle PeopleSoft (component: Grants). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Grants. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Grants accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Grants accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 4.8,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"cvssV4_0": {}
},
"nvd_repo_path": "2026/CVE-2026-61056.json",
"references": [
"https://www.oracle.com/security-alerts/cpujul2026.html"
],
"title": null,
"updated": "2026-08-04T18:09:42.870000+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$peoplesoft_enterprise_fin_grants"
],
"weaknesses": [
"CWE-284"
]
},
"opencve": {
"changes": [
{
"created": "2026-07-21T22:00:00+00:00",
"data": [
{
"details": {
"new": "Vulnerability in the PeopleSoft Enterprise FIN Grants product of Oracle PeopleSoft (component: Grants). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Grants. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Grants accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Grants accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).",
"old": null
},
"type": "description"
},
{
"details": [
"oracle",
"oracle$PRODUCT$peoplesoft_enterprise_fin_grants"
],
"type": "first_time"
},
{
"details": {
"added": [
"cpe:2.3:a:oracle:peoplesoft_enterprise_fin_grants:9.2:*:*:*:*:*:*:*"
],
"removed": []
},
"type": "cpes"
},
{
"details": {
"added": [
"oracle",
"oracle$PRODUCT$peoplesoft_enterprise_fin_grants"
],
"removed": []
},
"type": "vendors"
},
{
"details": {
"added": [
"https://www.oracle.com/security-alerts/cpujul2026.html"
],
"removed": []
},
"type": "references"
},
{
"details": {
"added": {
"cvssV3_1": {
"score": 4.8,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "4b475cff-b4a9-4865-aa96-ec992c9d9314"
},
{
"created": "2026-07-24T18:30:00+00:00",
"data": [
{
"details": {
"added": [
"CWE-284"
],
"removed": []
},
"type": "weaknesses"
},
{
"details": {
"added": {
"ssvc": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "partial"
},
"version": "2.0.3"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "96789256-699d-4c1e-8a6b-8a3a353c8ede"
},
{
"created": "2026-07-28T20:15:00+00:00",
"data": [
{
"details": {
"new": "Unauthenticated HTTP Access Allows Unauthorized Data Modification and Read in Oracle PeopleSoft Enterprise FIN Grants",
"old": null
},
"type": "title"
}
],
"id": "d97a52b4-b631-499b-a24a-d7f40e542013"
},
{
"created": "2026-08-02T20:30:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "Unauthenticated HTTP Access Allows Unauthorized Data Modification and Read in Oracle PeopleSoft Enterprise FIN Grants"
},
"type": "title"
}
],
"id": "2120d9cb-8d68-4697-af6c-b53fcb422362"
}
],
"cpes": {
"data": [
"cpe:2.3:a:oracle:peoplesoft_enterprise_fin_grants:9.2:*:*:*:*:*:*:*"
],
"providers": [
"mitre",
"nvd"
]
},
"created": {
"data": "2026-07-21T21:37:54.192000+00:00",
"provider": "mitre"
},
"description": {
"data": "Vulnerability in the PeopleSoft Enterprise FIN Grants product of Oracle PeopleSoft (component: Grants). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Grants. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Grants accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Grants accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).",
"provider": "mitre"
},
"metrics": {
"cvssV2_0": {
"data": {},
"provider": null
},
"cvssV3_0": {
"data": {},
"provider": null
},
"cvssV3_1": {
"data": {
"score": 4.8,
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
"provider": "mitre"
},
"cvssV4_0": {
"data": {},
"provider": null
},
"epss": {
"data": {
"score": 0.00222
},
"provider": "first"
},
"kev": {
"data": {},
"provider": null
},
"ssvc": {
"data": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "partial"
},
"version": "2.0.3"
},
"provider": "vulnrichment"
},
"threat_severity": {
"data": null,
"provider": null
}
},
"references": {
"data": [
"https://www.oracle.com/security-alerts/cpujul2026.html"
],
"providers": [
"mitre",
"nvd"
]
},
"title": {
"data": null,
"provider": null
},
"updated": {
"data": "2026-08-02T20:15:13.465196+00:00",
"provider": "enrichment"
},
"vendors": {
"data": [
"oracle",
"oracle$PRODUCT$peoplesoft_enterprise_fin_grants"
],
"providers": [
"mitre",
"nvd",
"enrichment"
]
},
"weaknesses": {
"data": [
"CWE-284"
],
"providers": [
"nvd",
"vulnrichment"
]
}
},
"vulnrichment": {
"cpes": [],
"created": "2026-07-21T21:37:54.192000+00:00",
"description": "Vulnerability in the PeopleSoft Enterprise FIN Grants product of Oracle PeopleSoft (component: Grants). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Grants. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Grants accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Grants accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {},
"cvssV4_0": {},
"kev": {},
"ssvc": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "partial"
},
"version": "2.0.3"
}
},
"references": [],
"title": null,
"updated": "2026-07-24T14:32:18.149000+00:00",
"vendors": [],
"vulnrichment_repo_path": "2026/61xxx/CVE-2026-61056.json",
"weaknesses": [
"CWE-284"
]
}
}