Oracle PeopleSoft CVE-2026-61063

Exploitation requires the attacker to hold a valid low-privileged logon (PR:L) to the infrastructure where PeopleSoft Enterprise SCM Supplier Contract Management 9.2 executes - this is not remote unauthenticated; the CVSS AV:L confirms local/authenticated access to the hosting environment is mandatory. The exploit targets the 'Security' component of the Supplier Contract Management module and needs no victim user interaction (UI:N). Limiting factors are that the attacker must already be authenticated to the environment and the deployment must be the affected 9.2 version. The requirement for an existing account plus local access is the primary constraint that reduces realistic exposure below what the raw 8.8 score implies, confining risk largely to insiders or attackers who have already gained a foothold.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H describes a locally-accessible, low-complexity attack needing only low privileges and no user interaction, resulting in full C/I/A compromise plus a scope change - which is why the score reaches 8.8 despite the local vector. The AV:L is decisive: the attacker must already hold an authenticated foothold ('logon to the infrastructure where the product executes'), which limits opportunistic mass exploitation and frames this as an insider or post-initial-access threat rather than an internet-facing RCE. No EPSS score was supplied, no POC is identified, and the CVE is not in CISA KEV, so there is no evidence of active or widespread exploitation. Realistic priority is high for organizations running PeopleSoft SCM 9.2 with many low-privileged accounts, but the local-access prerequisite tempers urgency relative to a network-exploitable equivalent. Note also that the input tag 'Information Disclosure' conflicts with the full C/I/A takeover described in the vector and Oracle text - treat Oracle's description and CVSS vector as authoritative over the tag.

A low-privileged user who already holds a valid logon to the PeopleSoft SCM infrastructure - for example a routine internal ERP or supplier-facing account - invokes the vulnerable Security-component functionality to escalate access and take over the Supplier Contract Management application. Because the attack produces a scope change, the attacker can then pivot to affect additional PeopleSoft resources on the same platform. No public exploit code has been identified, and the local, low-complexity nature means a successful attempt needs an existing account but little sophistication.