This vulnerability exists in Oracle PeopleSoft Enterprise SCM Supplier Contract Management version 9.2 within the security component. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure where the product runs. Successful exploitation can lead to complete compromise of the PeopleSoft Enterprise SCM Supplier Contract Management system, with potential scope change affecting additional Oracle products. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects local attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this vulnerability.

Exploitation of this vulnerability can result in full takeover of the PeopleSoft Enterprise SCM Supplier Contract Management product, compromising confidentiality, integrity, and availability of the system. The vulnerability's scope change means that additional Oracle products may also be significantly impacted. The CVSS score of 8.8 confirms a high impact severity. There are no known exploits in the wild at this time.

Oracle has released a Critical Patch Update advisory in July 2026 covering numerous security vulnerabilities across its product portfolio, including PeopleSoft products. However, the advisory does not explicitly confirm the availability of a patch or official fix for CVE-2026-61063. Customers should consult the Oracle Critical Patch Update July 2026 advisory directly for the latest patch availability and installation instructions. Until an official fix is confirmed and applied, organizations should restrict logon access to the affected infrastructure to trusted users only and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.