What is the CVSS score of CVE-2026-61201?

CVE-2026-61201 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-61201?

Oracle PeopleSoft Enterprise CRM Common Objects version 9.2.23 is vulnerable to unauthenticated remote compromise with CVSS 9.0 severity, enabling attackers to fully compromise the CRM module and…

How to fix or mitigate CVE-2026-61201?

Within 24 hours, inventory all systems running PeopleSoft Enterprise CRM Common Objects 9.2.23, assess external network exposure through HTTP/HTTPS protocols, and enable enhanced HTTP/HTTPS logging and alerting for this component. Within 7 days, implement firewall rules restricting network access to the CRM Common Objects component to only trusted source systems; deploy web application firewall rules to inspect HTTP traffic patterns; and contact Oracle support for patch availability timeline and interim mitigation guidance. Within 30 days, prepare phased deployment of vendor patches when released; evaluate temporary operational workarounds or component isolation to reduce attack surface if patches remain unavailable; and assess lateral movement risk to other PeopleSoft modules for cascading compromise scenarios.

Oracle PeopleSoft CVE-2026-61201

EUVD-2026-47405 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-96rx-7562-wwhj

Privilege Escalation Oracle Peoplesoft Enterprise Crm Common Objects

9.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Unauthenticated HTTP reach (AV:N/PR:N/UI:N) with vendor-confirmed difficult exploitation (AC:H), full takeover (C/I/A:H), and cross-product impact justifying the scope change (S:C).

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:15 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.0

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CRM Common Objects product of Oracle PeopleSoft (component: Common Objects). The supported version that is affected is 9.2.23. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CRM Common Objects. While the vulnerability is in PeopleSoft Enterprise CRM Common Objects, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CRM Common Objects. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle PeopleSoft Enterprise CRM Common Objects 9.2.23 is possible by a remote, unauthenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Although the flaw resides in the CRM Common Objects component, a scope change means a successful attack can cascade into other PeopleSoft products and result in complete takeover of the affected component. Oracle rates it CVSS 9.0 but flags it as difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

PeopleSoft Enterprise CRM Common Objects is a shared module within Oracle's PeopleSoft CRM suite, which runs on the PeopleSoft PeopleTools middleware stack (typically a WebLogic-based web/application server tier fronting a database). 'Common Objects' provides reusable data structures and services consumed across CRM applications, which is consistent with the CVSS scope change (S:C): code executing in the CRM component's security context can affect resources managed by other PeopleSoft products. Oracle did not assign a CWE (CWE: N/A), so the exact root-cause class is not published; the 'Information Disclosure' tag combined with full Confidentiality/Integrity/Availability impact and takeover language suggests a serious server-side flaw reachable through the HTTP-exposed application tier rather than a purely client-side or read-only issue.

RemediationAI

Apply the fix from Oracle's July 2026 Critical Patch Update; Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html (no discrete fix version number is published in the CPU beyond the patch bundle, so apply the CPU-designated patch for PeopleSoft CRM 9.2.23). Until patched, reduce exposure of the HTTP-facing PeopleSoft application tier: restrict network access to the PeopleSoft web/portal endpoints to trusted internal networks or VPN and remove direct internet exposure (trade-off: may block legitimate external self-service CRM users and partners), place a WAF or reverse proxy in front of the CRM portal with monitoring of anomalous requests to CRM Common Objects endpoints (trade-off: rules for an undisclosed vector are best-effort and may not fully block exploitation), and increase logging/alerting on the CRM and downstream PeopleSoft components given the scope-change impact. These are compensating controls only; the CPU patch is the authoritative remediation.