EUVD-2026-47268
GHSA-fc4c-xw35-g8pp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector and low-privileged logon are stated in the description (AV:L/PR:L), no user interaction, and 'takeover' justifies high C/I/A on an unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise SCM Order Management product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise SCM Order Management executes to compromise PeopleSoft Enterprise SCM Order Management. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise SCM Order Management. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of Oracle PeopleSoft Enterprise SCM Order Management 9.2 is possible for any low-privileged user who can log on to the infrastructure where the application runs, via a flaw in its Security component. A successful attack yields complete compromise of confidentiality, integrity, and availability of the Order Management module. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update.
Technical ContextAI
PeopleSoft Enterprise SCM Order Management is part of Oracle's PeopleSoft supply-chain management application suite, an enterprise ERP platform typically deployed on an application server (PeopleSoft PIA/Tuxedo) tier backed by a relational database. The affected element is the 'Security' component of Order Management, meaning the weakness lies in the module's own authorization or access-control logic rather than the network stack. Oracle did not assign a CWE (CWE: N/A), so the precise root-cause class is not published; the CVSS local vector (AV:L) combined with high impact across C/I/A and the 'takeover' language is consistent with a privilege-escalation or broken-access-control weakness exploitable by an already-authenticated infrastructure user. Oracle-published CVEs characteristically omit CPE strings and technical internals, so exact affected sub-components beyond 'version 9.2' are not enumerated.
RemediationAI
Apply the fixes from Oracle's July 2026 Critical Patch Update, which addresses this CVE for PeopleSoft Enterprise SCM Order Management 9.2 - Patch available per vendor advisory; the exact tagged patch level is not enumerated in the source data, so consult https://www.oracle.com/security-alerts/cpujul2026.html and the corresponding PeopleSoft update image to identify the precise bundle for your environment. As Oracle CPU fixes are cumulative, install the latest CPU rather than only this bundle. Because the attack requires local logon to the application infrastructure and only low privileges, compensating controls until patching completes should focus on tightening who can authenticate to that tier: restrict and audit interactive and application accounts on the PeopleSoft app-server hosts, enforce least privilege and remove unnecessary logon accounts (trade-off: may disrupt legitimate batch or integration users if over-restricted), and increase monitoring of the Order Management Security component and privileged-role changes for anomalous activity. These controls reduce the attacker pool but do not close the underlying flaw, so patching remains the only definitive fix.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) lets remot
Unauthorized data disclosure in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) allows a remo
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today