What is the CVSS score of CVE-2026-61089?

CVE-2026-61089 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Peoplesoft Enterprise Scm Inventory are affected by CVE-2026-61089?

Oracle PeopleSoft Enterprise SCM Inventory 9.2 contains an unauthenticated remote vulnerability permitting attackers to access and alter critical inventory data without credentials, directly…

How to fix or mitigate CVE-2026-61089?

Within 24 hours: audit network access logs for Oracle PeopleSoft Enterprise SCM 9.2 instances to identify exploitation attempts and inventory all affected systems in production. Within 7 days: implement network segmentation restricting PeopleSoft SCM 9.2 to authenticated internal access only (block direct internet-facing exposure), deploy Web Application Firewall rules blocking suspicious API and HTTP requests to the application, and disable non-essential API endpoints. Within 30 days: engage Oracle support to evaluate upgrade paths to patched PeopleSoft versions, schedule controlled upgrade of version 9.2 to a patched release with procurement stakeholder coordination, and conduct post-upgrade security validation and access re-certification.

Peoplesoft Enterprise Scm Inventory CVE-2026-61089

EUVD-2026-47300 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-xwgg-3xhr-8rp4

Authentication Bypass Oracle Peoplesoft Enterprise Scm Inventory

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:54 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise SCM Inventory product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Inventory. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Inventory accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM Inventory accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Unauthenticated data compromise in Oracle PeopleSoft Enterprise SCM Inventory 9.2 (Security component) lets a remote attacker reach the application over HTTP and read all data the module can access, plus perform limited unauthorized updates, inserts or deletes. Oracle rates it CVSS 3.1 8.2 and the intelligence tags it as an authentication-bypass class issue, meaning no valid credentials or user interaction are needed. No public exploit identified at time of analysis and it is not on CISA KEV, but the low-complexity, network-facing, no-privilege profile makes it a high-priority patch for Oracle ERP operators.