This vulnerability affects Oracle PeopleSoft Enterprise SCM Order Management 9.2 and is classified under CWE-284 (Improper Access Control). It permits an unauthenticated attacker with network access over HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data within the product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality and integrity impacts without availability impact. The vulnerability is publicly known and published but no known exploits in the wild have been reported. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by PeopleSoft Enterprise SCM Order Management 9.2. This compromises confidentiality and integrity of the system's data, potentially affecting business operations and data trustworthiness. There is no reported impact on availability. The vulnerability requires no authentication or user interaction, increasing risk.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. However, the advisory does not explicitly confirm a patch or remediation for CVE-2026-61059. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance. Oracle strongly recommends applying all relevant security patches promptly once available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to the affected service where possible.