What is the CVSS score of EUVD-2026-47271?

EUVD-2026-47271 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle PeopleSoft are affected by EUVD-2026-47271?

Oracle PeopleSoft Enterprise SCM Order Management 9.2 contains a critical authentication bypass vulnerability that allows any internet-connected attacker to read, modify, and delete all order…

How to fix or mitigate EUVD-2026-47271?

Within 24 hours: identify and inventory all PeopleSoft Order Management 9.2 instances; immediately isolate any systems directly exposed to the internet or untrusted networks; establish a security war room for ongoing monitoring. Within 7 days: deploy a Web Application Firewall with rules enforcing strict authentication checks on the Security component; implement network segmentation to restrict access to the Order Management module to known legitimate sources only; enable comprehensive audit logging of all data access and modifications; conduct vulnerability scanning to confirm internal exposure. Within 30 days: establish a formal engagement with Oracle regarding patch timeline and interim patches; evaluate encryption of sensitive order data at rest; schedule emergency maintenance windows for immediate deployment of the vendor patch upon release.

Oracle PeopleSoft EUVD-2026-47271

| CVE-2026-61059 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-vgrp-f75g-67mm

Authentication Bypass Oracle Peoplesoft Enterprise Scm Order Management

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Oracle confirms unauthenticated HTTP-reachable, easily exploitable access (AV:N/AC:L/PR:N/UI:N) with full read/write data impact (C:H/I:H) and no availability effect (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:03 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise SCM Order Management product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Order Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise SCM Order Management accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Order Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated data compromise in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) lets remote attackers read, create, modify, or delete all data accessible to the application over HTTP. Tagged as an authentication bypass, the flaw carries a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact but no availability impact, and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

PeopleSoft Enterprise SCM (Supply Chain Management) Order Management is a module within Oracle's PeopleSoft ERP suite, a Java/PeopleTools-based web application typically fronted by WebLogic and accessed via HTTP. The affected 'Security' component and the 'Authentication Bypass' tag indicate the root cause lies in the application's access-control or authentication enforcement layer rather than in business logic, allowing an actor to reach protected data without valid credentials. No CWE was assigned by NVD, so the precise weakness class (e.g., improper authentication vs. missing authorization) is not formally classified in the available data; the CVSS scope is Unchanged (S:U), meaning impact is confined to the PeopleSoft application's own data domain.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (CPU) documented at https://www.oracle.com/security-alerts/cpujul2026.html - this is the primary and vendor-authoritative remediation; treat it as Patch available per vendor advisory, since Oracle CPUs ship version-specific patch sets rather than a single named build for the affected 9.2 release. Prioritize any internet-facing PeopleSoft Order Management instances first. Until the CPU is applied, compensating controls include restricting network access to the PeopleSoft HTTP endpoints to trusted internal networks or VPN only (trade-off: breaks external/partner access to Order Management), placing a WAF or reverse proxy in front to filter anomalous requests to the affected module (trade-off: rules may be imperfect against an authentication-bypass path), and increasing monitoring of authentication and data-access logs for unauthorized reads or modifications. Do not rely on credentials as a control since the flaw is unauthenticated.