This vulnerability affects Oracle PeopleSoft Enterprise SCM Inventory version 9.2 and permits an unauthenticated attacker with network access over HTTPS to compromise the system, resulting in unauthorized access to sensitive data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact with no integrity or availability impact. The vulnerability is publicly known and assigned CVE-2026-61085. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation level for this specific issue.

Successful exploitation allows an unauthenticated attacker to access critical or all accessible data in PeopleSoft Enterprise SCM Inventory 9.2, compromising confidentiality. There is no impact on integrity or availability. The vulnerability is exploitable remotely over HTTPS without any authentication or user interaction, making it a significant risk for data exposure.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities including this one. However, the advisory does not explicitly confirm a patch or remediation level for CVE-2026-61085. Customers should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Applying the latest Oracle patches promptly is strongly recommended. Patch status is not yet confirmed for this specific vulnerability—check the vendor advisory for current remediation guidance.