EUVD-2026-47299
GHSA-wc3g-2v7q-cjqx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed PeopleSoft PIA endpoint
-
DeliverySend crafted HTTP request to SCM Manufacturing
-
ExploitBypass authentication in Security component
-
ExecutionRead critical manufacturing data
-
ImpactExfiltrate confidential ERP records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only HTTP network access to a PeopleSoft Enterprise SCM Manufacturing 9.2 deployment with the web-facing PeopleSoft Internet Architecture exposed; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low attack complexity against the affected version. The primary limiting factor is network reachability of the PIA/Manufacturing endpoints - instances confined to internal networks or fronted by an authenticating gateway materially reduce exposure - and the flaw is scoped specifically to version 9.2 of the SCM Manufacturing product, so non-9.2 or non-SCM PeopleSoft deployments are outside the stated affected scope. |
| Impact | The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction - the highest-exposure profile short of also affecting integrity or availability, which are rated N (C:H/I:N/A:N), capping the score at 7.5. Oracle characterizes it as 'easily exploitable,' reinforcing the low-complexity rating. However, no EPSS score, no POC, and no KEV listing are present in the provided data, so despite the alarming vector there is currently no evidence of active or imminent widespread exploitation - prioritization should be driven by the unauthenticated-read exposure of sensitive ERP data rather than confirmed in-the-wild activity. Note a mild tension: the 'Authentication Bypass' tag combined with C:H/I:N/A:N suggests read-only data exposure rather than full account takeover, so treat the auth-bypass label as indicative, not confirmation of write/control, until Oracle's advisory detail is reviewed. |
| Exploit ScenarioDerived | An attacker on the network sends crafted HTTP requests to the internet- or intranet-facing PeopleSoft SCM Manufacturing web interface and, exploiting the security/authentication-bypass flaw, retrieves manufacturing and supply-chain data without providing valid credentials. Because the attack requires no authentication, no user interaction, and low complexity, it can be scripted against any reachable PeopleSoft 9.2 instance. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Unauthorized data disclosure in Oracle PeopleSoft Enterprise SCM Manufacturing 9.2 (Security component) allows a remote, unauthenticated attacker with HTTP network access to read critical manufacturing and supply-chain data. Oracle rates the flaw as easily exploitable with a CVSS 3.1 base score of 7.5 (confidentiality-only impact), and vendor tagging associates it with an authentication-bypass class of issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the Oracle Critical Patch Update for July 2026, which addresses this issue; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch bundle applicable to PeopleSoft Enterprise SCM Manufacturing 9.2 (Patch available per vendor advisory - an exact fix version string was not provided in the source data, so validate the specific PeopleTools/SCM patch number in the CPU matrix). Until patched, reduce exposure by restricting network reachability of the PeopleSoft Internet Architecture (PIA) web endpoints to trusted networks or VPN, placing the Manufacturing servlets behind a WAF or reverse proxy that enforces authentication, and monitoring HTTP access logs for anomalous unauthenticated requests to SCM Manufacturing pages; note that network restrictions may impede legitimate remote or supplier access and should be scoped accordingly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PeopleSoft Enterprise SCM is Oracle's supply-chain management ERP suite; the Manufacturing module handles production planning, BOMs, work orders and shop-floor data, exposed through the web-facing PeopleSoft Internet Architecture (PIA) over HTTP. The defect resides in the product's Security component, and Oracle's own tagging labels it an Authentication Bypass, implying a flaw in access-control or session handling that lets requests reach protected data without valid credentials. The NVD entry carries no CWE (CWE: N/A), so the precise weakness class is not formally categorized, but the confidentiality-only impact combined with the auth-bypass tag points to a broken-access-control / improper-authentication root cause rather than memory corruption.
Know when Peoplesoft Enterprise Scm Manufacturing gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated remote HTTP access with low complexity and no user interaction yields PR:N/AC:L/AV:N; impact is data disclosure only, so C:H with I:N/A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise SCM Manufacturing product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Manufacturing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Manufacturing accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Executive ViewAI
Oracle PeopleSoft Enterprise SCM Manufacturing 9.2 contains a critical authentication bypass vulnerability allowing remote attackers to access sensitive supply-chain, production planning, and inventory data without credentials. This easily exploitable flaw directly threatens procurement visibility, demand forecasting accuracy, and competitive positioning, requiring immediate network isolation and monitoring while vendor patches are developed.
No vendor-released patch identified at time of analysis. Implement compensating controls: (1) Restrict SCM 9.2 network access via firewall to authorized internal users only, blocking all external connections; (2) Deploy network segmentation to isolate affected systems from the internet and untrusted networks; (3) Enable detailed audit logging and real-time alerting on data access attempts; (4) Implement reverse-proxy HTTP request filtering to detect and block suspicious patterns associated with unauthorized data disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB