EUVD-2026-47297
GHSA-57f6-h65w-ffx2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach PeopleSoft PIA over HTTPS
-
DeliverySend crafted request to Order Management
-
ExploitBypass authentication in Security component
-
ExecutionRead critical SCM/order data
-
ImpactExfiltrate accessible data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network HTTPS access to a PeopleSoft Enterprise SCM Order Management 9.2 instance's web tier; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and low attack complexity - effectively remote unauthenticated read access against affected default deployments reachable over the network. The primary limiting factor is network exposure: instances confined to internal networks, behind VPN, or with IP-restricted PIA endpoints are not remotely exploitable by external attackers, and only version 9.2 is in scope. Impact is limited to data confidentiality (no write/modify or denial of service). |
| Impact | Signals are partially conflicting and incomplete. The CVSS vector (AV:N/AC:L/PR:N/UI:N) points to a network-reachable, low-complexity, unauthenticated attack with no user interaction - a genuine remote data-exposure risk, and the 'Authentication Bypass' tag reinforces the unauthenticated read scenario. However, the impact is bounded to confidentiality (7.5, not critical), with no integrity or availability effect. There is no EPSS score, no KEV listing, no SSVC decision, and no POC in the provided data, so real-world exploitation likelihood is unquantified; Oracle CPU-class issues are frequently patched before mass exploitation. Net: prioritize because it is unauthenticated and network-facing over HTTPS, but note the absence of EPSS/KEV/POC means urgency rests on the vendor's 'easily exploitable' characterization rather than confirmed active exploitation. |
| Exploit ScenarioDerived | An attacker who can reach the PeopleSoft Order Management web interface over HTTPS sends crafted requests that bypass authentication in the Security component, retrieving order, customer, or other SCM data without any valid login. Given AC:L and PR:N, no special timing, credentials, or user interaction is required. No public POC is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Unauthorized data disclosure in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) allows a remote, unauthenticated attacker with HTTPS network access to read critical or all data accessible to the application. Rated CVSS 3.1 7.5 (confidentiality-only), the flaw is described by Oracle as easily exploitable and is tagged as an authentication bypass. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 as referenced at https://www.oracle.com/security-alerts/cpujul2026.html; no discrete fix version string is published in the input beyond the CPU bundle, so treat the July 2026 CPU as the patch baseline (Patch available per vendor advisory). Until the CPU is applied, reduce exposure by restricting network reachability to the PeopleSoft PIA/web tier - place it behind a VPN or IP allowlist and terminate untrusted internet access to the Order Management endpoints, accepting that this limits legitimate external/partner access; additionally enforce web-application-firewall rules and web-server access controls in front of PIA to constrain unauthenticated requests to Order Management URLs, understanding a WAF is a stopgap that may not fully block an authentication-bypass path. Because the issue is confidentiality-only, prioritize protecting environments holding sensitive order/customer data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PeopleSoft Enterprise SCM (Supply Chain Management) Order Management is an enterprise ERP module deployed on Oracle's PeopleTools/PeopleSoft Internet Architecture (PIA), a Java/web-tier stack fronted by web and application servers communicating over HTTPS. The vulnerability sits in the 'Security' component, and the vendor tag 'Authentication Bypass' indicates the root cause class is improper authentication/access control (broadly CWE-287/CWE-306, though the CVE lists CWE as N/A). Because the CVSS impact is confidentiality-only (C:H, I:N, A:N), the weakness appears to expose data-read paths without permitting modification or disruption, consistent with an access-control gap that lets requests reach protected data without valid session credentials.
Know when Peoplesoft Enterprise Scm Order Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated (PR:N) network HTTPS access with low complexity per vendor 'easily exploitable'; confidentiality-only data exposure so C:H, I:N, A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise SCM Order Management product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise SCM Order Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Order Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Executive ViewAI
Oracle PeopleSoft Enterprise SCM Order Management 9.2 contains an authentication bypass vulnerability (CVSS 7.5) allowing remote, unauthenticated access to read all data accessible to the application. Organizations using this product face risk of unauthorized exposure of sensitive order management, customer, and operational data, creating potential compliance and business impact consequences.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to SCM Order Management systems via firewall segmentation, implement reverse proxy or authentication gateway to add authorization enforcement, enable and monitor detailed audit logs for data access patterns, consider operational access restrictions if feasible, and establish 24/7 monitoring for suspicious access attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) lets remot
Full takeover of Oracle PeopleSoft Enterprise SCM Order Management 9.2 is possible for any low-privileged user who can l
Exploit-DB