CVE-2026-61201 in PeopleSoft Enterprise CRM Common Objects
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise CRM Common Objects product of Oracle PeopleSoft (component: Common Objects). The supported version that is affected is 9.2.23. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CRM Common Objects. While the vulnerability is in PeopleSoft Enterprise CRM Common Objects, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CRM Common Objects. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise CRM Common Objects component version 9.2.23, representing a critical security flaw that can be exploited by unauthenticated remote attackers. The vulnerability falls under the CVSS 3.1 scoring system with a base score of 9.0, indicating high severity across all impact vectors including confidentiality, integrity, and availability. The attack vector is network-based requiring no authentication or user interaction, making it particularly dangerous as it can be exploited from any location with network access to the affected system.
The technical flaw resides in the Common Objects component of PeopleSoft Enterprise CRM, which serves as a foundational element for various customer relationship management functionalities. This vulnerability allows attackers to gain complete control over the affected Common Objects functionality, potentially enabling them to manipulate core business processes and data management systems. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates that while the attack requires high complexity to execute, no privileges are needed for initial access and the scope of impact extends beyond the vulnerable component itself.
The operational implications of this vulnerability are severe and far-reaching, as successful exploitation can lead to complete system compromise of PeopleSoft Enterprise CRM Common Objects. Attackers who successfully exploit this vulnerability could potentially access sensitive customer data, modify business processes, disrupt operations, and gain persistent access to critical enterprise systems. The scope change aspect of this vulnerability means that impacts may extend beyond the immediate Common Objects component to affect other interconnected products within the PeopleSoft ecosystem, creating cascading security risks throughout the organization's CRM infrastructure.
Organizations should implement immediate mitigations including network segmentation to limit access to the affected systems, implementing robust firewall rules to restrict HTTP access, and applying available Oracle security patches as soon as they become available. The vulnerability aligns with CWE-284 (Improper Access Control) and may be related to ATT&CK techniques involving privilege escalation and persistence mechanisms. Security teams should also conduct comprehensive network monitoring to detect potential exploitation attempts and establish incident response procedures specifically addressing this type of remote code execution vulnerability. Regular vulnerability assessments and security audits should be performed to identify similar weaknesses in the broader PeopleSoft deployment environment and other enterprise applications that may share similar architectural components or dependencies.