Peoplesoft Enterprise Scm Inventory CVE-2026-61089

Oracle PeopleSoft Enterprise SCM Inventory 9.2 contains an unauthenticated remote vulnerability permitting attackers to access and alter critical inventory data without credentials, directly threatening supply chain operations and data integrity. With no vendor patch currently available, organizations running this version face immediate exposure to data exfiltration and unauthorized modifications affecting procurement and operational continuity.

Within 24 hours: audit network access logs for Oracle PeopleSoft Enterprise SCM 9.2 instances to identify exploitation attempts and inventory all affected systems in production. Within 7 days: implement network segmentation restricting PeopleSoft SCM 9.2 to authenticated internal access only (block direct internet-facing exposure), deploy Web Application Firewall rules blocking suspicious API and HTTP requests to the application, and disable non-essential API endpoints. Within 30 days: engage Oracle support to evaluate upgrade paths to patched PeopleSoft versions, schedule controlled upgrade of version 9.2 to a patched release with procurement stakeholder coordination, and conduct post-upgrade security validation and access re-certification.

No vendor-released patch identified at time of analysis. Interim mitigations: enforce network-level access restrictions limiting PeopleSoft SCM 9.2 to authenticated internal networks; deploy WAF rules to filter anomalous API traffic; implement detailed audit logging for all data access, modifications, and administrative actions; restrict administrative interfaces to hardened jump-host access; establish real-time alerting for unusual inventory data changes and unauthorized API activity.