This vulnerability affects Oracle PeopleSoft Enterprise SCM Order Management version 9.2, specifically its security component. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure hosting the application. Successful exploitation can lead to full compromise and takeover of the PeopleSoft Enterprise SCM Order Management system. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for this specific CVE. The vendor strongly recommends applying available patches promptly to mitigate risks.

The vulnerability allows an attacker with low privileges and logon access to the infrastructure to fully compromise PeopleSoft Enterprise SCM Order Management 9.2. This results in complete loss of confidentiality, integrity, and availability of the affected application, effectively enabling an attacker to take over the system.

Oracle's July 2026 Critical Patch Update advisory should be consulted for patch availability and installation instructions. Although the advisory does not explicitly confirm a patch for CVE-2026-61055, Oracle strongly recommends applying all relevant security patches without delay to mitigate exploitation risks. Until a confirmed patch is available, restrict logon access to the infrastructure hosting PeopleSoft Enterprise SCM Order Management and monitor for suspicious activity. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.