CVE-2026-61209 affects Oracle PeopleSoft In-Memory Project Discovery version 9.2. It is an easily exploitable vulnerability that permits a low privileged attacker with network access over HTTP to compromise the product. The vulnerability's impact extends beyond the immediate product, potentially affecting other Oracle products (scope change). Successful exploitation can result in complete takeover of PeopleSoft In-Memory Project Discovery. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this vulnerability in the provided excerpt.

The vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise PeopleSoft In-Memory Project Discovery 9.2. This includes takeover of the product and potential impact on additional Oracle products due to scope change. The confidentiality, integrity, and availability of the affected system are all critically impacted, as reflected by the CVSS score of 9.9.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities across Oracle products. However, the provided advisory content does not explicitly confirm the availability of a patch or fix for CVE-2026-61209. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, organizations should consider restricting network access to the affected product and monitor for any unusual activity related to PeopleSoft In-Memory Project Discovery. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.