What is the CVSS score of CVE-2026-61209?

CVE-2026-61209 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Peoplesoft In Memory Project Discovery are affected by CVE-2026-61209?

Oracle PeopleSoft In-Memory Project Discovery 9.2 contains a critical remote code execution vulnerability (CVSS 9.9) allowing low-privileged attackers over HTTP to achieve complete system takeover,…

How to fix or mitigate CVE-2026-61209?

Within 24 hours, identify all Oracle PeopleSoft In-Memory Project Discovery 9.2 deployments and isolate them from untrusted networks, allowing access only from verified internal IP ranges. Within 7 days, deploy Web Application Firewall rules to restrict HTTP access to Project Discovery endpoints, implement enhanced logging and alerting for access attempts, and audit all low-privilege account permissions to Project Discovery. Within 30 days, apply the vendor patch immediately upon release from Oracle, or execute a planned migration to supported PeopleSoft versions unaffected by CVE-2026-61209; do not extend network controls as permanent remediation.

Peoplesoft In Memory Project Discovery CVE-2026-61209

EUVD-2026-47411 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-vjf4-g5c9-mm9w

Privilege Escalation Oracle Peoplesoft In Memory Project Discovery

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:12 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the PeopleSoft In-Memory Project Discovery product of Oracle PeopleSoft (component: Project Discovery). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft In-Memory Project Discovery. While the vulnerability is in PeopleSoft In-Memory Project Discovery, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of PeopleSoft In-Memory Project Discovery. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle PeopleSoft In-Memory Project Discovery 9.2 is possible when a low-privileged attacker with network access over HTTP exploits the Project Discovery component, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change (S:C), meaning successful attacks can significantly impact additional products beyond the vulnerable component itself, with complete loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low exploitation barrier make it a high remediation priority.