Oracle PeopleSoft CVE-2026-61077

Exploitation requires local logon access to the infrastructure where PeopleSoft Enterprise SCM Mobile Inventory Management 9.2 runs (AV:L), plus a valid low-privileged account (PR:L) - this is not remotely reachable by an anonymous internet attacker. The vulnerability lives in the Security component of the Mobile Inventory Management module, and Oracle tags it Authentication Bypass, indicating the attacker leverages an authorization/identity-enforcement weakness to exceed their granted access. Exploitation is explicitly rated Difficult by Oracle (AC:H), meaning success depends on specific conditions the attacker cannot fully control. Limiting factors that reduce real-world risk: the attacker must already be authenticated to the host with some privilege, no user interaction is available to help them, and the high complexity plus local-only vector confine exploitation to insiders or already-compromised hosts rather than opportunistic mass attacks. The precise configuration trigger is not detailed in Oracle's advisory and should be confirmed against the CPU documentation.

The signals are mixed and warrant prioritization below its 7.5 headline score. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) requires local logon to the infrastructure, low but non-zero privileges, and a high-complexity attack - meaning the attacker must already be an authenticated insider or have footholded the host, and must satisfy special conditions to succeed. This is not remote-unauthenticated mass-exploitation material. There is no CISA KEV listing (not actively exploited), no POC identified, and no EPSS score was provided in the intelligence, so probabilistic exploitation likelihood cannot be quantified from this data. No SSVC decision was supplied. The elevated score is driven by the scope change plus full confidentiality and integrity impact, not by ease of access. Note a tension worth verifying with the vendor: the CVSS vector requires PR:L (an existing low-privileged account), yet the Oracle 'Authentication Bypass' tag implies circumventing authentication - verify with Oracle whether the entry point is a partially-authenticated user escalating authorization rather than a truly pre-auth bypass. Realistic priority is medium: patch in the normal Oracle CPU cycle, prioritized higher only where untrusted or numerous low-privilege users share the PeopleSoft infrastructure.

An authenticated low-privilege user of the PeopleSoft SCM Mobile Inventory application - or an attacker who has gained a foothold with a local account on the hosting infrastructure - abuses a flaw in the Security component to escalate their authorization, then reads and tampers with inventory and related critical business data beyond their assigned scope. Because of the scope change, the same access can be leveraged to reach data in other PeopleSoft products in the environment. The high attack complexity (AC:H) means the attacker must satisfy specific non-trivial conditions to succeed, and no public POC is currently identified.