PeopleSoft SCM Purchasing CVE-2026-61205

The required condition is network reachability to the PeopleSoft Enterprise SCM Purchasing (PIA) HTTP interface of a version 9.2 deployment; per CVSS AV:N/AC:L/PR:N/UI:N and Oracle's 'easily exploitable' language, no authentication, no elevated privileges, and no user interaction are needed against affected instances. The concrete limiting factors are therefore that the target must be PeopleSoft Enterprise SCM Purchasing 9.2 specifically (other versions not evaluated) and the vulnerable Purchasing HTTP endpoint must be reachable by the attacker - so instances confined to internal networks or behind VPN/WAF are far less exposed than internet-facing PIA servers. No non-default feature toggle is named in the source data as a prerequisite, so exploitation should be assumed possible against default 9.2 Purchasing configurations pending vendor confirmation.

The signals point to a genuine patch-soon priority rather than a high-CVSS-but-low-real-risk case: the CVSS 3.1 base is 8.2 with the most attacker-favorable exploitability metrics (AV:N/AC:L/PR:N/UI:N), Oracle explicitly calls it 'easily exploitable' by an unauthenticated attacker, and the 'Authentication Bypass' tag reinforces low barrier to entry. Impact is asymmetric - I:H (unauthorized create/delete/modify of critical Purchasing data) but only C:L (read of a data subset) and A:N (no availability impact) - so the primary threat is procurement data integrity, tampering and fraud, not disclosure or outage. No EPSS score, SSVC decision, POC, or KEV listing was provided, so exploitation probability and automatability cannot be quantified from the input; the absence of KEV/POC lowers immediate 'under active attack' urgency but does NOT reduce the ease of exploitation Oracle asserts. CWE is N/A, so the precise root cause and any non-default preconditions are unconfirmed - verify affected configurations against the Oracle CPU advisory.

An attacker who can reach the PeopleSoft PIA web interface over HTTP sends crafted requests to the Purchasing component that bypass authentication/authorization and invoke data-mutating operations. With no credentials and no user interaction, they create, alter, or delete purchase orders, vendor, or requisition records - enabling procurement fraud or data corruption - and read a subset of Purchasing data. No public exploit code has been identified at time of analysis, but Oracle's 'easily exploitable' rating implies a low technical barrier once the endpoint is reachable.