Peoplesoft Enterprise Cc Common Application Objects CVE-2026-61078

Oracle PeopleSoft Enterprise CC Common Application Objects version 9.2 contains a cross-context data flaw allowing low-privileged attackers to read and modify critical business data by targeting users with malicious content. This directly compromises data confidentiality and integrity across affected PeopleSoft deployments and requires immediate containment to prevent unauthorized data exposure or modification.

Within 24 hours, restrict network access to PeopleSoft 9.2 instances from external networks and distribute security advisory to all users warning against suspicious content interaction. Within 7 days, deploy web application firewall rules to block malicious payloads, implement strict input validation and output encoding on the Common Application Objects component, segment PeopleSoft 9.2 from production networks, and audit user access logs for anomalous data access patterns. Within 30 days, contact Oracle for patched version availability and upgrade timeline, evaluate migration to supported PeopleSoft versions, and implement comprehensive application-level defenses including content security policy headers and enhanced session monitoring.

No vendor-released patch identified at time of analysis. Interim controls: restrict network access to PeopleSoft 9.2 instances to internal trusted networks only, deploy web application firewall with payload inspection targeting stored XSS and session-riding attack vectors, enforce strict input validation and output encoding, implement session monitoring and anomaly detection for data access, restrict user permissions to least-privilege levels, apply network segmentation isolating affected systems, and conduct mandatory security awareness training on social engineering and malicious content vectors.