CVE-2026-61210 in PeopleSoft SCM Manufacturing
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise SCM Manufacturing product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise SCM Manufacturing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise SCM Manufacturing accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Manufacturing accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle PeopleSoft Enterprise SCM Manufacturing version 9.2, specifically targeting the security component of the system. The flaw represents a significant security weakness that can be exploited by unauthenticated attackers who gain network access through the HTTPS protocol. The CVSS 3.1 base score of 7.4 indicates a high-severity vulnerability with substantial impact on both confidentiality and integrity of the affected system. The attack vector requires network access via HTTPS, suggesting that the vulnerability may be accessible from external networks without requiring prior authentication or privileged access. The security implications are particularly concerning as successful exploitation can lead to unauthorized modification of critical data including creation, deletion, and modification operations across all accessible data within the PeopleSoft Enterprise SCM Manufacturing environment.
The technical nature of this vulnerability allows attackers to achieve comprehensive access to sensitive information and operational capabilities within the manufacturing system. The impact extends beyond simple data theft to include complete control over critical business processes that rely on the SCM manufacturing module. Attackers can potentially manipulate production schedules, inventory management systems, and other manufacturing-related data that could severely disrupt business operations and compromise operational integrity. This vulnerability directly affects the confidentiality aspect of the CIA triad by enabling unauthorized access to sensitive manufacturing data while simultaneously impacting integrity through the potential for unauthorized modifications that could alter critical business processes. The CVSS vector analysis indicates high attack complexity (AC:H) suggesting that while the vulnerability is difficult to exploit, it remains a real threat to organizations using this specific version of PeopleSoft.
Organizations utilizing Oracle PeopleSoft Enterprise SCM Manufacturing 9.2 face substantial operational risks from this vulnerability as it could enable attackers to compromise entire manufacturing data repositories without authentication. The potential for unauthorized access to critical manufacturing data includes production schedules, resource allocation information, quality control metrics, and other sensitive operational parameters that are essential for business continuity. The impact on business operations could extend beyond immediate data compromise to include disruption of manufacturing processes, supply chain coordination issues, and potential financial losses from operational inefficiencies. This vulnerability aligns with CWE categories related to insecure direct object references and insufficient authentication mechanisms, representing a fundamental weakness in the application's security architecture. The lack of required privileges for exploitation makes this particularly dangerous as it does not require attackers to first compromise legitimate user accounts or escalate privileges through additional attack vectors.
The recommended mitigation strategies should include immediate implementation of Oracle's security patches and updates specifically designed to address this vulnerability. Organizations must also consider network-level security controls including firewalls, intrusion detection systems, and access controls to limit exposure to this vulnerability. Security monitoring should be enhanced to detect potential exploitation attempts targeting this specific weakness in the PeopleSoft system. Regular security assessments and vulnerability scanning should be conducted to identify similar vulnerabilities within the broader Oracle PeopleSoft ecosystem. Additionally, implementing network segmentation and reducing attack surface through proper configuration management can help minimize the potential impact of successful exploitation attempts. The vulnerability represents a clear violation of standard security practices outlined in various cybersecurity frameworks including those referenced in MITRE ATT&CK methodology for credential access and privilege escalation techniques that attackers might attempt to leverage from such weaknesses.