CVE-2026-61209
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft In-Memory Project Discovery product of Oracle PeopleSoft (component: Project Discovery). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft In-Memory Project Discovery. While the vulnerability is in PeopleSoft In-Memory Project Discovery, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of PeopleSoft In-Memory Project Discovery. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle PeopleSoft's In-Memory Project Discovery component, which is part of the broader PeopleSoft suite running on version 9.2. The flaw represents a critical security weakness that can be exploited by low-privileged attackers who gain network access through HTTP protocols. The vulnerability's severity is classified as easily exploitable, meaning that malicious actors with minimal privileges and network connectivity can potentially compromise the system without requiring extensive technical expertise or specialized tools.
The technical nature of this vulnerability stems from insufficient access controls or authentication mechanisms within the In-Memory Project Discovery functionality. Attackers can leverage their network access to manipulate system behavior through HTTP requests, potentially leading to complete system takeover. This type of vulnerability typically falls under CWE-284 (Improper Access Control) or similar access control weaknesses that allow unauthorized users to gain elevated privileges or execute malicious operations within the targeted application.
The operational impact of this vulnerability extends beyond the immediate scope of In-Memory Project Discovery, as indicated by the scope change aspect mentioned in the description. This means that successful exploitation could potentially affect other interconnected PeopleSoft products or systems within the organization's infrastructure. The CVSS 3.1 base score of 9.9 represents a critical severity level, indicating high impact across all three core security principles: confidentiality, integrity, and availability. Attackers could potentially steal sensitive data, corrupt system information, or disrupt service availability.
The attack vector requires network access via HTTP, which suggests that the vulnerability exists in web-facing components of the PeopleSoft application. This makes it particularly dangerous as organizations typically expose web applications to external networks for legitimate business purposes, creating an accessible attack surface. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) confirms that this is a network-based attack requiring low complexity but only low privilege level, with no user interaction required and a high impact across all security dimensions.
Organizations should implement immediate mitigations including patching the affected PeopleSoft version 9.2, implementing network segmentation to limit access to the vulnerable component, and strengthening authentication mechanisms. Security monitoring should be enhanced to detect unusual HTTP traffic patterns targeting the In-Memory Project Discovery functionality. The vulnerability's classification aligns with ATT&CK techniques involving privilege escalation and credential access, making it particularly concerning for enterprise environments where PeopleSoft systems handle sensitive business data and financial information.