What is the CVSS score of CVE-2026-61086?

CVE-2026-61086 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of PeopleSoft Enterprise SCM are affected by CVE-2026-61086?

Oracle PeopleSoft Enterprise SCM Order Management 9.2 contains an authentication bypass vulnerability (CVSS 7.5) allowing remote, unauthenticated access to read all data accessible to the…

How to fix or mitigate CVE-2026-61086?

Within 24 hours, identify all systems running Oracle PeopleSoft Enterprise SCM Order Management 9.2 in your environment, review HTTPS access logs for suspicious remote connections, and contact Oracle support for guidance. Within 7 days, implement network-based access controls to restrict SCM Order Management 9.2 systems to known authorized users and networks only, enable comprehensive application access logging to detect exploitation attempts, and establish monitoring baselines. Within 30 days, coordinate with Oracle and your technical team to plan and test any patches or remediation steps when vendor guidance becomes available.

PeopleSoft Enterprise SCM CVE-2026-61086

EUVD-2026-47297 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-57f6-h65w-ffx2

Authentication Bypass Oracle Peoplesoft Enterprise Scm Order Management

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated (PR:N) network HTTPS access with low complexity per vendor 'easily exploitable'; confidentiality-only data exposure so C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:55 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise SCM Order Management product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise SCM Order Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Order Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) allows a remote, unauthenticated attacker with HTTPS network access to read critical or all data accessible to the application. Rated CVSS 3.1 7.5 (confidentiality-only), the flaw is described by Oracle as easily exploitable and is tagged as an authentication bypass. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

PeopleSoft Enterprise SCM (Supply Chain Management) Order Management is an enterprise ERP module deployed on Oracle's PeopleTools/PeopleSoft Internet Architecture (PIA), a Java/web-tier stack fronted by web and application servers communicating over HTTPS. The vulnerability sits in the 'Security' component, and the vendor tag 'Authentication Bypass' indicates the root cause class is improper authentication/access control (broadly CWE-287/CWE-306, though the CVE lists CWE as N/A). Because the CVSS impact is confidentiality-only (C:H, I:N, A:N), the weakness appears to expose data-read paths without permitting modification or disruption, consistent with an access-control gap that lets requests reach protected data without valid session credentials.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 as referenced at https://www.oracle.com/security-alerts/cpujul2026.html; no discrete fix version string is published in the input beyond the CPU bundle, so treat the July 2026 CPU as the patch baseline (Patch available per vendor advisory). Until the CPU is applied, reduce exposure by restricting network reachability to the PeopleSoft PIA/web tier - place it behind a VPN or IP allowlist and terminate untrusted internet access to the Order Management endpoints, accepting that this limits legitimate external/partner access; additionally enforce web-application-firewall rules and web-server access controls in front of PIA to constrain unauthenticated requests to Order Management URLs, understanding a WAF is a stopgap that may not fully block an authentication-bypass path. Because the issue is confidentiality-only, prioritize protecting environments holding sensitive order/customer data.