EUVD-2026-47271
GHSA-vgrp-f75g-67mm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach PeopleSoft HTTP endpoint
-
ExploitSend crafted request bypassing authentication
-
ExecutionAccess Order Management data layer
-
ImpactRead or modify critical order/customer data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP/HTTPS reachability to an Oracle PeopleSoft Enterprise SCM Order Management 9.2 instance with the vulnerable Security component; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and Oracle's 'easily exploitable' wording, no authentication, no special configuration, and no user interaction are needed against affected default deployments. The primary limiting factor is network exposure: instances confined to internal/segmented networks or behind VPN are far less reachable than internet-facing ones. Exploitation is also bounded to version 9.2 of this specific SCM Order Management module - other PeopleSoft modules or versions are not listed as affected - and impact is limited to data the application can access (S:U), with no availability/denial-of-service effect. |
| Impact | All signals point to a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity attack needing no privileges and no user interaction - the easiest exploitation profile - and Oracle's own description reinforces this by calling it 'easily exploitable' by an 'unauthenticated attacker with network access via HTTP.' Impact is high for both confidentiality and integrity (C:H/I:H) with no availability effect (A:N), consistent with data theft and tampering rather than service disruption. No EPSS score, SSVC decision, POC, or KEV entry is present in the provided data, so real-world exploitation likelihood cannot be quantified; the absence of KEV/POC signals means exploitation is not yet confirmed, but the low barrier to attack and internet-facing nature of many PeopleSoft deployments make this a strong patch-now candidate. No signals conflict - description and CVSS vector agree on unauthenticated network exploitation. |
| Exploit ScenarioDerived | An attacker who can reach a PeopleSoft Order Management login or application URL over HTTP sends crafted requests that bypass authentication, then reads or alters order, customer, and supply-chain records without any account. Because no user interaction or privileges are required, this can be automated at scale against exposed instances. No public proof-of-concept is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Unauthenticated data compromise in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) lets remote attackers read, create, modify, or delete all data accessible to the application over HTTP. Tagged as an authentication bypass, the flaw carries a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact but no availability impact, and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (CPU) documented at https://www.oracle.com/security-alerts/cpujul2026.html - this is the primary and vendor-authoritative remediation; treat it as Patch available per vendor advisory, since Oracle CPUs ship version-specific patch sets rather than a single named build for the affected 9.2 release. Prioritize any internet-facing PeopleSoft Order Management instances first. Until the CPU is applied, compensating controls include restricting network access to the PeopleSoft HTTP endpoints to trusted internal networks or VPN only (trade-off: breaks external/partner access to Order Management), placing a WAF or reverse proxy in front to filter anomalous requests to the affected module (trade-off: rules may be imperfect against an authentication-bypass path), and increasing monitoring of authentication and data-access logs for unauthorized reads or modifications. Do not rely on credentials as a control since the flaw is unauthenticated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PeopleSoft Enterprise SCM (Supply Chain Management) Order Management is a module within Oracle's PeopleSoft ERP suite, a Java/PeopleTools-based web application typically fronted by WebLogic and accessed via HTTP. The affected 'Security' component and the 'Authentication Bypass' tag indicate the root cause lies in the application's access-control or authentication enforcement layer rather than in business logic, allowing an actor to reach protected data without valid credentials. No CWE was assigned by NVD, so the precise weakness class (e.g., improper authentication vs. missing authorization) is not formally classified in the available data; the CVSS scope is Unchanged (S:U), meaning impact is confined to the PeopleSoft application's own data domain.
Know when Peoplesoft Enterprise Scm Order Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Oracle confirms unauthenticated HTTP-reachable, easily exploitable access (AV:N/AC:L/PR:N/UI:N) with full read/write data impact (C:H/I:H) and no availability effect (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise SCM Order Management product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Order Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise SCM Order Management accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Order Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle PeopleSoft Enterprise SCM Order Management 9.2 contains a critical authentication bypass vulnerability that allows any internet-connected attacker to read, modify, and delete all order management data without credentials. This represents complete compromise of supply chain and order processing systems with no currently available vendor patch.
Deploy Web Application Firewall with authentication enforcement rules; restrict network access via firewall ACLs to known trusted IP ranges and business partners only; require VPN for any remote access to Order Management functions; enable real-time monitoring and alerting on data access anomalies, bulk queries, and account authentication failures; implement role-based access controls with least-privilege principles; encrypt order and payment data both in transit and at rest; consider temporary operational safeguards such as read-only access for non-critical functions if feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Full takeover of Oracle PeopleSoft Enterprise SCM Order Management 9.2 is possible for any low-privileged user who can l
Unauthorized data disclosure in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) allows a remo
Exploit-DB