CVE-2026-61077: Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise SCM Mobile Inventory Management executes to compromise PeopleSoft Enterprise SCM Mobile Inventory Management. While the vulnerability is in PeopleSoft Enterprise SCM Mobile Inventory Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or
CVE-2026-61077 is a high-severity vulnerability in Oracle PeopleSoft Enterprise SCM Mobile Inventory Management version 9.2. It allows a low privileged attacker with logon access to the infrastructure to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 base score of 7.5, indicating significant confidentiality and integrity impacts. Exploitation is difficult and requires high attack complexity. The vulnerability may also impact additional PeopleSoft products beyond the initial scope. Oracle has published a Critical Patch Update advisory in July 2026 that includes security patches for multiple products, but no explicit patch information for this specific vulnerability is confirmed in the advisory content provided.
AI Analysis
Technical Summary
This vulnerability affects Oracle PeopleSoft Enterprise SCM Mobile Inventory Management version 9.2. It allows a low privileged attacker who has logon access to the infrastructure where the product runs to compromise the application. The vulnerability can lead to unauthorized creation, deletion, or modification of critical data within PeopleSoft Enterprise SCM Mobile Inventory Management, with potential scope change impacting additional products. The CVSS 3.1 vector is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, reflecting local attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts without availability impact. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this vulnerability. No known exploits in the wild have been reported.
Potential Impact
Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within PeopleSoft Enterprise SCM Mobile Inventory Management. The vulnerability affects confidentiality and integrity of data with potential broader impact on additional PeopleSoft products due to scope change. There is no impact on availability. The attack requires local access with valid logon credentials and is difficult to exploit due to high attack complexity.
Mitigation Recommendations
Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities across its product portfolio. However, the advisory does not explicitly confirm the availability of a patch for CVE-2026-61077. Customers should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply relevant patches promptly. Until an official patch is confirmed and applied, restrict access to the infrastructure hosting PeopleSoft Enterprise SCM Mobile Inventory Management to trusted users only and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-61077: Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise SCM Mobile Inventory Management executes to compromise PeopleSoft Enterprise SCM Mobile Inventory Management. While the vulnerability is in PeopleSoft Enterprise SCM Mobile Inventory Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or
Description
CVE-2026-61077 is a high-severity vulnerability in Oracle PeopleSoft Enterprise SCM Mobile Inventory Management version 9.2. It allows a low privileged attacker with logon access to the infrastructure to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 base score of 7.5, indicating significant confidentiality and integrity impacts. Exploitation is difficult and requires high attack complexity. The vulnerability may also impact additional PeopleSoft products beyond the initial scope. Oracle has published a Critical Patch Update advisory in July 2026 that includes security patches for multiple products, but no explicit patch information for this specific vulnerability is confirmed in the advisory content provided.
CVSS v3.1
Score 7.5high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Oracle PeopleSoft Enterprise SCM Mobile Inventory Management version 9.2. It allows a low privileged attacker who has logon access to the infrastructure where the product runs to compromise the application. The vulnerability can lead to unauthorized creation, deletion, or modification of critical data within PeopleSoft Enterprise SCM Mobile Inventory Management, with potential scope change impacting additional products. The CVSS 3.1 vector is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, reflecting local attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts without availability impact. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this vulnerability. No known exploits in the wild have been reported.
Potential Impact
Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within PeopleSoft Enterprise SCM Mobile Inventory Management. The vulnerability affects confidentiality and integrity of data with potential broader impact on additional PeopleSoft products due to scope change. There is no impact on availability. The attack requires local access with valid logon credentials and is difficult to exploit due to high attack complexity.
Mitigation Recommendations
Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities across its product portfolio. However, the advisory does not explicitly confirm the availability of a patch for CVE-2026-61077. Customers should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply relevant patches promptly. Until an official patch is confirmed and applied, restrict access to the infrastructure hosting PeopleSoft Enterprise SCM Mobile Inventory Management to trusted users only and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:55.612Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fee299c2644c7f8d5d068
Added to database: 07/21/2026, 22:09:45 UTC
Last enriched: 07/22/2026, 01:52:31 UTC
Last updated: 07/22/2026, 01:52:31 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.