PeopleSoft Enterprise CVE-2026-61307

Exploitation requires network-level reachability to the Oracle Net protocol endpoint on the target PeopleSoft 9.2 instance - no authentication is required per the PR:N CVSS metric. The AC:H metric (Oracle's own 'difficult to exploit' characterization) implies that beyond basic network access, specific technical conditions must align, such as a race condition, particular server state, or protocol sequencing requirement; the exact condition is not disclosed in the CVE description or references. Exploitation is limited to PeopleSoft Enterprise CC Common Application Objects version 9.2 only - no other versions are confirmed affected. Limiting factors include: the high attack complexity reducing the likelihood of reliable or automated exploitation, and the dependency on Oracle Net protocol reachability which should be restricted to internal application tiers in well-segmented environments.

The CVSS 8.1 base score reflects network accessibility (AV:N), no required authentication (PR:N), and full system compromise potential (C:H/I:H/A:H), which collectively represent a severe threat profile on paper. However, the AC:H metric - corresponding to the Oracle description of 'difficult to exploit' - materially reduces real-world risk compared to straightforward remote code execution vulnerabilities. AC:H typically indicates a race condition, specific sequencing requirement, or dependency on a non-default but plausible state. No EPSS score is available in the provided data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept code has been identified, further limiting opportunistic threat actor risk. SSVC signals suggest the exploitation status is 'none' at time of analysis, automation potential is indeterminate without knowing the exact flaw class, and technical impact is 'total' given the full takeover descriptor. Priority should be moderate-to-high for organizations with Oracle Net endpoints exposed to untrusted networks, and lower (but not negligible) for installations fully isolated behind internal network perimeters.

An unauthenticated attacker with network access to an Oracle Net endpoint on a PeopleSoft Enterprise 9.2 deployment sends specially crafted Oracle Net protocol messages targeting the CC Common Application Objects component. The attacker satisfies the high-complexity preconditions (exact nature unknown due to absent CWE and technical detail) and triggers the underlying flaw, resulting in complete compromise of the PeopleSoft instance - including data exfiltration, data manipulation, and service disruption. No public proof-of-concept is known, suggesting this scenario currently requires advanced adversary capability.