What is the CVSS score of CVE-2026-61078?

CVE-2026-61078 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Peoplesoft Enterprise Cc Common Application Objects are affected by CVE-2026-61078?

Oracle PeopleSoft Enterprise CC Common Application Objects version 9.2 contains a cross-context data flaw allowing low-privileged attackers to read and modify critical business data by targeting…

How to fix or mitigate CVE-2026-61078?

Within 24 hours, restrict network access to PeopleSoft 9.2 instances from external networks and distribute security advisory to all users warning against suspicious content interaction. Within 7 days, deploy web application firewall rules to block malicious payloads, implement strict input validation and output encoding on the Common Application Objects component, segment PeopleSoft 9.2 from production networks, and audit user access logs for anomalous data access patterns. Within 30 days, contact Oracle for patched version availability and upgrade timeline, evaluate migration to supported PeopleSoft versions, and implement comprehensive application-level defenses including content security policy headers and enhanced session monitoring.

Peoplesoft Enterprise Cc Common Application Objects CVE-2026-61078

EUVD-2026-47289 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-rrrw-pmr6-5xq9

Authentication Bypass Oracle Peoplesoft Enterprise Cc Common Application Objects

8.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:56 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.7

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Common Application Objects). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise CC Common Application Objects, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CC Common Application Objects accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

AnalysisAI

Cross-context data compromise in Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 (Common Application Objects component) allows a low-privileged, network-based attacker to gain unauthorized read and write access to critical data after tricking a legitimate user into interacting with malicious content. The scope-changing nature (S:C) combined with the Authentication Bypass tag and required user interaction is consistent with a stored cross-site scripting or session-riding style flaw whose impact spills over into additional PeopleSoft products. No public exploit identified at time of analysis and the flaw is not on CISA KEV.