CVE-2026-61089 in PeopleSoft Enterprise SCM Inventory
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise SCM Inventory product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Inventory. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Inventory accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM Inventory accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle PeopleSoft Enterprise SCM Inventory component version 9.2, representing a critical security flaw that enables unauthenticated network-based attacks through HTTP protocols. The vulnerability's classification as easily exploitable indicates that attackers require minimal technical expertise or resources to execute successful compromises, making it particularly dangerous in production environments where such systems often handle sensitive inventory and financial data. The CVSS 3.1 base score of 8.2 reflects the high severity of this flaw, with confidentiality impacts rated as high and integrity impacts rated as low, suggesting that while data theft is the primary concern, modifications to system data could also occur.
The technical nature of this vulnerability stems from insufficient authentication mechanisms within the HTTP interface of the PeopleSoft SCM Inventory module, allowing unauthorized actors to bypass normal access controls without requiring valid credentials. This represents a fundamental failure in the principle of least privilege and authentication enforcement, creating pathways for attackers to gain unauthorized access to critical business data including inventory records, transaction histories, and potentially sensitive financial information. The vulnerability's impact extends beyond simple data access, as successful exploitation can also enable unauthorized modification of inventory data, allowing attackers to insert, update, or delete records at will.
From an operational perspective, this vulnerability poses significant risks to organizations utilizing PeopleSoft SCM Inventory systems, particularly those handling large volumes of inventory data across multiple business units. The potential for complete data compromise means that attackers could access all accessible data within the system, potentially exposing trade secrets, supplier information, customer data, and financial records. Additionally, the unauthorized update, insert, or delete capabilities provide attackers with substantial opportunities to manipulate inventory levels, create false transactions, or corrupt database integrity, leading to operational disruptions and potential financial losses.
Organizations should implement immediate mitigations including network-level restrictions such as firewall rules limiting access to the affected HTTP endpoints, implementing strong authentication mechanisms for all system interfaces, and conducting comprehensive network segmentation to isolate critical PeopleSoft components. The vulnerability aligns with CWE-287 which addresses improper authentication issues, and corresponds to ATT&CK technique T1078 for valid accounts and T1566 for social engineering attacks that may exploit this weakness. Regular security assessments, patch management programs, and monitoring of network traffic for suspicious activity related to the affected system components are essential defensive measures. System administrators should also consider implementing intrusion detection systems specifically configured to identify attempts targeting PeopleSoft SCM Inventory interfaces and maintain detailed audit logs for forensic analysis following any suspected compromise events.