CVE-2026-61088 affects Oracle PeopleSoft Enterprise SCM Manufacturing component Security in version 9.2. It is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact with no integrity or availability impact. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm the patch status for this specific vulnerability. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible through PeopleSoft Enterprise SCM Manufacturing version 9.2. This compromises confidentiality but does not affect integrity or availability. The vulnerability is exploitable remotely without authentication, increasing the risk of data breaches.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple security vulnerabilities across its products, including PeopleSoft Enterprise SCM Manufacturing. Although the advisory does not explicitly confirm the patch status for CVE-2026-61088, users are strongly advised to review the July 2026 Critical Patch Update advisory and apply the relevant patches promptly. Maintaining up-to-date patches is critical as Oracle reports ongoing attempts to exploit vulnerabilities that have available fixes. No vendor advisory states that no action is required or that the issue is already mitigated.