CVE-2026-61207: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM eProcurement. While the vulnerability is in PeopleSoft Enterprise SCM eProcurement, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM eProcurement accessible data as well as unauthori
Vulnerability in the PeopleSoft Enterprise SCM eProcurement product of Oracle PeopleSoft (component: Manage Requisition Status). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM eProcurement. While the vulnerability is in PeopleSoft Enterprise SCM eProcurement, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM eProcurement accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM eProcurement accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
AI Analysis
Technical Summary
This vulnerability affects Oracle PeopleSoft Enterprise SCM eProcurement version 9.2 in the Manage Requisition Status component. It is easily exploitable by unauthenticated attackers over HTTP, allowing them to compromise the system with significant confidentiality and integrity impacts. Successful exploitation can lead to unauthorized access to critical data and unauthorized modification of accessible data. The vulnerability has a CVSS 3.1 score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), indicating network attack vector, low attack complexity, no privileges or user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle’s July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for it.
Potential Impact
An attacker can remotely exploit this vulnerability without authentication to gain unauthorized access to critical data within PeopleSoft Enterprise SCM eProcurement 9.2. They may also perform unauthorized updates, inserts, or deletions on some accessible data. The vulnerability affects confidentiality and integrity, potentially compromising sensitive business information and data integrity within the affected system. The scope of impact may extend beyond the eProcurement product to other related Oracle products.
Mitigation Recommendations
Oracle’s July 2026 Critical Patch Update advisory includes multiple security patches across many products, including PeopleSoft components. However, the advisory does not explicitly confirm a patch or official fix for CVE-2026-61207. Customers should review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, organizations should consider restricting network access to the affected PeopleSoft Enterprise SCM eProcurement 9.2 system to trusted users only and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-61207: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM eProcurement. While the vulnerability is in PeopleSoft Enterprise SCM eProcurement, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM eProcurement accessible data as well as unauthori
Description
Vulnerability in the PeopleSoft Enterprise SCM eProcurement product of Oracle PeopleSoft (component: Manage Requisition Status). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM eProcurement. While the vulnerability is in PeopleSoft Enterprise SCM eProcurement, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM eProcurement accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM eProcurement accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
CVSS v3.1
Score 9.3critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Oracle PeopleSoft Enterprise SCM eProcurement version 9.2 in the Manage Requisition Status component. It is easily exploitable by unauthenticated attackers over HTTP, allowing them to compromise the system with significant confidentiality and integrity impacts. Successful exploitation can lead to unauthorized access to critical data and unauthorized modification of accessible data. The vulnerability has a CVSS 3.1 score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), indicating network attack vector, low attack complexity, no privileges or user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle’s July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for it.
Potential Impact
An attacker can remotely exploit this vulnerability without authentication to gain unauthorized access to critical data within PeopleSoft Enterprise SCM eProcurement 9.2. They may also perform unauthorized updates, inserts, or deletions on some accessible data. The vulnerability affects confidentiality and integrity, potentially compromising sensitive business information and data integrity within the affected system. The scope of impact may extend beyond the eProcurement product to other related Oracle products.
Mitigation Recommendations
Oracle’s July 2026 Critical Patch Update advisory includes multiple security patches across many products, including PeopleSoft components. However, the advisory does not explicitly confirm a patch or official fix for CVE-2026-61207. Customers should review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, organizations should consider restricting network access to the affected PeopleSoft Enterprise SCM eProcurement 9.2 system to trusted users only and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:52:20.740Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fee3a9c2644c7f8d5db36
Added to database: 07/21/2026, 22:10:02 UTC
Last enriched: 08/13/2026, 13:20:02 UTC
Last updated: 08/30/2026, 22:52:13 UTC
Views: 52
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.