Oracle PeopleSoft CVE-2026-61201

Exploitation requires only network access via HTTP to the PeopleSoft Enterprise CRM Common Objects application (PR:N/UI:N - no authentication and no user interaction), meaning an exposed CRM web endpoint is the core prerequisite. The primary limiting factor is high attack complexity (AC:H): Oracle rates it 'difficult to exploit', indicating the attacker must satisfy conditions beyond their direct control - such as a specific server configuration, application state, or race/timing window - rather than firing a single reliable request. Exposure is further limited to the specific supported version 9.2.23 of PeopleSoft Enterprise CRM Common Objects, and realistic risk depends heavily on whether the PeopleSoft portal/CRM tier is reachable from untrusted networks versus internal-only.

The signals are mixed and warrant careful triage. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H = 9.0) shows a network-reachable, unauthenticated (PR:N), no-user-interaction path with full CIA impact and a scope change, which is severe on paper. However, Oracle explicitly labels it 'difficult to exploit' (AC:H), meaning success depends on conditions outside the attacker's control (timing, configuration, or specific state), which materially lowers the odds of reliable mass exploitation. There is no CISA KEV listing and no evidence of a public POC, so this is not confirmed actively exploited - the high score reflects worst-case impact, not demonstrated ease. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Net: treat as a high-priority patch for internet-exposed or widely-accessed PeopleSoft CRM instances due to unauthenticated reach and takeover impact, but the AC:H rating and absence of exploitation evidence argue against emergency out-of-band response absent internet exposure.

A remote attacker with no credentials sends crafted HTTP requests to an internet-reachable PeopleSoft CRM Common Objects endpoint and, after meeting the specific difficult-to-exploit conditions, triggers the flaw to take over the component and pivot into other PeopleSoft products via the scope change. Because AC:H applies, the attacker likely needs favorable timing or configuration state and may require multiple attempts; no public exploit code is known at time of analysis, so an adversary would need to develop the exploit independently.