What is the CVSS score of CVE-2026-61207?

CVE-2026-61207 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle PeopleSoft eProcurement are affected by CVE-2026-61207?

Oracle PeopleSoft Enterprise SCM eProcurement 9.2 contains a critical authentication bypass vulnerability (CVE-2026-61207) enabling remote attackers to read and modify procurement data without…

How to fix or mitigate CVE-2026-61207?

Within 24 hours: Inventory all systems running PeopleSoft eProcurement 9.2; for any internet-facing instances, immediately isolate or implement restrictive network segmentation to block external access. Within 7 days: Deploy firewall rules restricting HTTP/HTTPS traffic to the Manage Requisition Status component to trusted internal networks only; enable transaction logging on all eProcurement activity; contact Oracle support to obtain patch timeline and risk assessment. Within 30 days: Establish daily reconciliation reports of requisitions and purchase orders to detect unauthorized changes; maintain 24/7 monitoring for suspicious access patterns; prepare accelerated patching procedures for deployment when vendor releases fix.

Oracle PeopleSoft eProcurement CVE-2026-61207

EUVD-2026-47410 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-7qxg-vvw9-mj59

Authentication Bypass Oracle Peoplesoft Enterprise Scm Eprocurement

9.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

9.3 CRITICAL

Unauthenticated network HTTP access with low complexity and no interaction (AV:N/AC:L/PR:N/UI:N); high confidentiality and low integrity exposure with a component-crossing scope change, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:12 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.3

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise SCM eProcurement product of Oracle PeopleSoft (component: Manage Requisition Status). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM eProcurement. While the vulnerability is in PeopleSoft Enterprise SCM eProcurement, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM eProcurement accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM eProcurement accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).

AnalysisAI

Unauthorized data compromise in Oracle PeopleSoft Enterprise SCM eProcurement 9.2 (Manage Requisition Status component) lets a remote, unauthenticated attacker read all module-accessible data and perform limited updates over HTTP, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 9.3 (Critical) and tagged as an authentication bypass, the flaw is easily exploitable without user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected technology is Oracle PeopleSoft, a PeopleTools-based enterprise resource planning (ERP) suite; specifically the Supply Chain Management (SCM) eProcurement application, version 9.2, in the 'Manage Requisition Status' component that handles procurement requisition workflow over HTTP via the PeopleSoft Internet Architecture (PIA) web/application server tier. Oracle did not assign a CWE (CWE: N/A), but the vendor 'Authentication Bypass' tag combined with PR:N and a scope change (S:C) points to a root-cause class where a pre-authentication request reaches privileged application logic, allowing the attacker's action to cross the security boundary of the vulnerable component into other PeopleSoft resources or integrated products. No CPE strings were supplied in the intelligence; affected-product identity rests on the Oracle/EUVD version string 'PeopleSoft Enterprise SCM eProcurement 9.2'.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update for July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle distributes PeopleSoft security fixes as CPU patch bundles rather than a single renamed release version, and no discrete fixed version string was provided in this intelligence, so treat 'apply the July 2026 CPU for PeopleSoft SCM eProcurement 9.2' as the primary remediation and confirm the exact patch/PRP number in the CPU advisory and My Oracle Support. Until patched, reduce exposure by restricting network reachability of the eProcurement PIA endpoints - place the PeopleSoft Internet Architecture behind a VPN or IP allowlist and remove direct internet exposure of the Manage Requisition Status pages, accepting that this limits legitimate external/self-service requisition users; add WAF rules in front of the eProcurement URLs to filter anomalous unauthenticated requests to the affected component, recognizing WAF signatures for an undisclosed Oracle flaw will be generic and may not fully block exploitation; and monitor application/web server logs for unauthenticated access to requisition-status functions. Because a scope change is involved, also review trust relationships and integrations from eProcurement to other PeopleSoft modules.