CVE-2026-61085 affects Oracle PeopleSoft Enterprise SCM Inventory version 9.2. It is a vulnerability in the security component that allows an unauthenticated attacker with network access over HTTPS to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 base score is 7.5, reflecting a high impact on confidentiality with no impact on integrity or availability. The vulnerability is classified under CWE-284 (Improper Access Control). The Oracle July 2026 Critical Patch Update advisory lists many patches but does not explicitly confirm a patch or remediation level for this specific vulnerability. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to unauthorized access to critical or all accessible data within PeopleSoft Enterprise SCM Inventory 9.2. This compromises confidentiality but does not affect data integrity or system availability. The vulnerability allows attackers to bypass authentication and gain network-level access to sensitive information.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to PeopleSoft Enterprise SCM Inventory 9.2 instances and monitor for unauthorized access attempts.