What is the CVSS score of CVE-2026-61085?

CVE-2026-61085 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Peoplesoft Enterprise Scm Inventory are affected by CVE-2026-61085?

Oracle PeopleSoft Enterprise SCM Inventory 9.2 contains an authentication bypass vulnerability (CVE-2026-61085, CVSS 7.5) that allows remote, unauthenticated attackers to access all sensitive supply…

How to fix or mitigate CVE-2026-61085?

Within 24 hours, conduct an asset inventory of all Oracle PeopleSoft SCM Inventory 9.2 instances and assess network exposure; immediately restrict network access to trusted internal networks only and require VPN authentication for any remote access. Within 7 days, deploy Web Application Firewall rules to filter requests targeting CVE-2026-61085, enable comprehensive audit logging of all data access and administrative actions, and implement network segmentation to isolate SCM Inventory systems from general production networks. Within 30 days, monitor the Oracle July 2026 Critical Patch Update for the official fix; develop a rapid deployment procedure to apply the patch within 48 hours of vendor release and continue interim monitoring and access controls until patched.

Peoplesoft Enterprise Scm Inventory CVE-2026-61085

EUVD-2026-47296 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-v7qc-5vm8-26cm

Authentication Bypass Oracle Peoplesoft Enterprise Scm Inventory

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:56 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise SCM Inventory product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise SCM Inventory. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Inventory accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle PeopleSoft Enterprise SCM Inventory 9.2 (Security component) allows a remote, unauthenticated attacker to reach sensitive data over HTTPS without any user interaction. Oracle rates the flaw easily exploitable and it is tagged as an authentication bypass, meaning an attacker can obtain read access to all data accessible to the SCM Inventory application. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a priority patch in the July 2026 Oracle Critical Patch Update.