Oracle PeopleSoft eProcurement CVE-2026-61207

The vulnerable surface is the 'Manage Requisition Status' component of PeopleSoft Enterprise SCM eProcurement 9.2, reachable over HTTP through the PeopleSoft Internet Architecture web/app tier - so the primary prerequisite is that this eProcurement application be network-accessible to the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the vulnerability requires no authentication, no user interaction, and only low complexity, and Oracle states default-supported version 9.2 is affected, so no special non-default configuration is indicated. The main limiting factor is network reachability: environments where the eProcurement PIA endpoints are not exposed to the attacker (internal-only, VPN-gated, or IP-restricted) meaningfully reduce exploitability, and the flaw is confined to version 9.2 of this specific SCM module rather than all PeopleSoft deployments.

The signals are largely consistent toward high priority: the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, high confidentiality impact, low integrity impact, no availability impact, and a scope change - yielding 9.3 Critical. Oracle explicitly calls it 'easily exploitable,' reinforcing the AC:L/PR:N reading. However, real-world urgency is tempered by missing signals: there is no EPSS score, no SSVC decision data, no KEV listing, and no evidence of public POC in the provided intelligence, so active/imminent exploitation cannot be asserted. The honest read is a genuinely dangerous pre-auth data-exposure flaw whose exploitation is technically trivial but not yet confirmed as occurring in the wild; prioritize patching on Oracle CPU cadence for internet-exposed PeopleSoft, while noting the absence of EPSS/KEV means the 'currently being exploited' question remains unverified from available data.

An attacker on the internet or an adjacent network sends crafted HTTP requests to an exposed PeopleSoft eProcurement 'Manage Requisition Status' endpoint without any credentials, bypassing authentication to read all data accessible to the module - such as requisition, supplier, and procurement records - and to make limited unauthorized inserts, updates, or deletes. The scope change means the attacker's foothold in eProcurement can be leveraged against additional connected PeopleSoft resources. No public exploit was identified at time of analysis, but the low attack complexity and lack of required interaction make exploitation straightforward if a working request is developed.