CVE-2026-61207 in PeopleSoft Enterprise SCM eProcurement
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise SCM eProcurement product of Oracle PeopleSoft (component: Manage Requisition Status). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM eProcurement. While the vulnerability is in PeopleSoft Enterprise SCM eProcurement, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM eProcurement accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM eProcurement accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise SCM eProcurement version 9.2, specifically affecting the Manage Requisition Status component. The flaw represents a critical security weakness that can be exploited by unauthenticated attackers through HTTP network connections without requiring any prior authentication or privileged access. The vulnerability's high severity is reflected in its CVSS 3.1 base score of 9.3, which indicates significant impact across confidentiality and integrity domains while maintaining a relatively low attack complexity.
The technical nature of this vulnerability stems from insufficient input validation and access control mechanisms within the eProcurement application's requisition management functionality. Attackers can leverage this weakness to gain unauthorized access to sensitive procurement data including vendor information, purchase orders, and requisition details that should remain protected. The vulnerability's scope extends beyond the immediate component, potentially affecting related Oracle PeopleSoft products due to shared architectural elements and common data access patterns. This broad impact demonstrates how vulnerabilities in enterprise applications can cascade across interconnected systems.
Operationally, successful exploitation of this vulnerability enables attackers to achieve complete unauthorized access to all data accessible through the eProcurement system while also permitting modification of existing records or creation of new entries. The confidentiality impact is rated as high, meaning sensitive procurement information could be exposed to unauthorized parties, potentially including competitive business data, financial details, and vendor contracts. The integrity impact rating of low suggests that while attackers can modify data, the primary concern remains unauthorized data access rather than destructive operations.
Organizations should implement immediate mitigations including network segmentation to restrict access to the affected application, deployment of web application firewalls to monitor and filter HTTP traffic, and comprehensive network monitoring to detect suspicious activities. The vulnerability aligns with CWE-284 (Improper Access Control) and represents a classic example of insufficient authorization checks that could be addressed through proper input validation and access control enforcement mechanisms. From an ATT&CK framework perspective, this vulnerability maps to techniques involving initial access through network services and privilege escalation by leveraging unauthenticated access to sensitive data systems.
Additional security measures should include regular patch management procedures to address known vulnerabilities, implementation of multi-factor authentication for administrative functions, and comprehensive auditing of user activities within the eProcurement environment. System administrators must conduct thorough risk assessments to identify all instances of the vulnerable component and ensure proper network access controls are implemented. The scope change aspect of this vulnerability underscores the importance of understanding how security weaknesses in one application can potentially affect broader enterprise ecosystems, requiring organizations to adopt comprehensive security monitoring approaches across their entire technology infrastructure rather than focusing solely on individual applications.