What is the CVSS score of CVE-2026-61205?

CVE-2026-61205 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of PeopleSoft SCM Purchasing are affected by CVE-2026-61205?

Oracle PeopleSoft Enterprise SCM Purchasing 9.2 contains an authentication bypass vulnerability (CVE-2026-61205, CVSS 8.2) allowing remote attackers to create, delete, and modify purchasing orders…

How to fix or mitigate CVE-2026-61205?

Within 24 hours: inventory all PeopleSoft Purchasing 9.2 installations, identify internet-exposed instances, and document critical purchasing workflows and user base. Within 7 days: restrict HTTP network access to the Purchasing module to known internal networks and VPN only; enable enhanced transaction-level audit logging with real-time alerts for batch purchasing operations; deploy WAF rules targeting suspicious API patterns in procurement endpoints. Within 30 days: contact Oracle for patched version timeline; if no patch exists within 90 days, execute compensating controls formally through change management and establish continuous monitoring for unauthorized purchasing activity.

PeopleSoft SCM Purchasing CVE-2026-61205

EUVD-2026-47409 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-v5r8-j7hf-mg66

Authentication Bypass Oracle Peoplesoft Enterprise Scm Purchasing

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

8.2 HIGH

Unauthenticated remote HTTP access with no user interaction (AV:N/AC:L/PR:N/UI:N); high integrity from unauthorized data create/delete/modify, limited read (C:L), no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:13 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise SCM Purchasing accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise SCM Purchasing accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N).

AnalysisAI

Unauthorized data modification in Oracle PeopleSoft Enterprise SCM Purchasing 9.2 (Purchasing component) allows a remote, unauthenticated attacker with HTTP network access to create, delete, or modify critical Purchasing data and read a subset of accessible data. Oracle rates it CVSS 3.1 8.2 and describes it as easily exploitable with no privileges or user interaction, and its own tagging characterizes the flaw as an authentication bypass. No public exploit code has been identified and it is not listed in CISA KEV at time of analysis, so risk is currently driven by exposure rather than confirmed active exploitation.

Technical ContextAI

PeopleSoft Enterprise SCM (Supply Chain Management) Purchasing is a web-based ERP procurement module in the Oracle PeopleSoft suite, delivered over the PeopleSoft Internet Architecture (PIA) and typically fronted by WebLogic/PIA web servers reachable over HTTP(S). The CVSS vector (AV:N/AC:L/PR:N/UI:N) combined with Oracle's 'Authentication Bypass' tag indicates the flaw lets requests reach or manipulate Purchasing functionality without a valid authenticated session or authorization check. No CWE was assigned by NVD or Oracle, but the behavior - unauthenticated network access yielding write and limited read to application data - is consistent with a broken/missing authentication or improper access control class (CWE-287 / CWE-306 / CWE-862). The high integrity impact (I:H) with only limited confidentiality (C:L) suggests the affected code path exposes data-mutating operations more broadly than data-reading ones.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for PeopleSoft Enterprise SCM Purchasing 9.2 - patch available per vendor advisory, though Oracle does not publish a discrete point-release version number in the source data, so identify the specific PeopleSoft patch/PRP bundle for your maintenance level from the CPU matrix. Because this is an unauthenticated network-facing flaw, prioritize internet-exposed PeopleSoft PIA instances first. Until the CPU is applied, reduce exposure with compensating controls: restrict HTTP access to the Purchasing/PIA endpoints to trusted internal networks or VPN (trade-off: may break external supplier or self-service access), place a WAF or reverse proxy in front of PIA to filter anomalous requests to Purchasing servlets (trade-off: tuning effort and possible false positives), and enable enhanced logging/monitoring of Purchasing data-change transactions to detect tampering. Do not rely on network filtering alone as a permanent fix - the CPU is the definitive remediation.