This vulnerability affects PeopleSoft Enterprise SCM eProcurement 9.2, specifically the Manage Requisition Status component. It is easily exploitable by unauthenticated attackers over HTTP, allowing them to gain unauthorized access to critical data and perform unauthorized data modifications. The vulnerability has a CVSS 3.1 score of 9.3 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly confirm a patch for this CVE in the provided excerpt. Customers are strongly advised to apply available patches promptly as per Oracle's general guidance.

Successful exploitation can lead to unauthorized access to critical data within PeopleSoft Enterprise SCM eProcurement and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability affects confidentiality and integrity but not availability. The scope change indicates potential impact on additional Oracle products beyond the initially affected component.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay. However, the provided advisory content does not explicitly confirm the availability of a patch for CVE-2026-61207. Organizations should monitor Oracle's official security alerts and apply relevant patches as soon as they are available. Until a patch is confirmed and applied, restrict network access to the affected PeopleSoft Enterprise SCM eProcurement 9.2 instances to trusted users only and consider additional compensating controls to limit exposure.