This vulnerability affects Oracle PeopleSoft Enterprise SCM Order Management 9.2 and allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data. Successful exploitation can result in unauthorized creation, deletion, or modification of data within the affected product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this vulnerability in the provided content. Customers are strongly advised to review Oracle's advisory and apply relevant patches promptly.

The vulnerability enables an unauthenticated attacker to compromise PeopleSoft Enterprise SCM Order Management 9.2 via HTTP, potentially leading to unauthorized creation, deletion, or modification of critical data. This results in a high impact on confidentiality and integrity of the system's data. There is no indication of availability impact. No known exploits in the wild have been reported at this time.

Oracle's July 2026 Critical Patch Update advisory includes multiple security patches across products. Although the advisory does not explicitly confirm a patch for CVE-2026-61059, Oracle recommends customers remain on actively supported versions and apply security patches without delay. Users of PeopleSoft Enterprise SCM Order Management 9.2 should monitor Oracle's advisory for patch availability and apply updates promptly once released. Until a patch is confirmed, consider restricting network access to the affected service to trusted users only.