What is the CVSS score of EUVD-2026-47275?

EUVD-2026-47275 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle PeopleSoft are affected by EUVD-2026-47275?

Oracle PeopleSoft Enterprise SCM Supplier Contract Management 9.2 contains a privilege escalation vulnerability (CVSS 8.8) that enables low-privileged infrastructure users to achieve full application…

How to fix or mitigate EUVD-2026-47275?

Within 24 hours, identify all systems running PeopleSoft SCM 9.2 and assess their connectivity to other enterprise systems to understand potential impact scope. Within 7 days, plan and test deployment of Oracle's July 2026 Critical Patch Update in a non-production environment, with special attention to integration points with connected products. Within 30 days, complete deployment of the patch across all affected production systems and validate that connected applications function correctly post-update.

Oracle PeopleSoft EUVD-2026-47275

| CVE-2026-61063 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-7vj3-w5fv-qx64

Privilege Escalation Oracle Peoplesoft Enterprise Scm Supplier Contract Management

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Local authenticated foothold gives AV:L/PR:L at low complexity; full takeover yields C:H/I:H/A:H, and stated impact on additional products supports S:C.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:01 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise SCM Supplier Contract Management product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise SCM Supplier Contract Management executes to compromise PeopleSoft Enterprise SCM Supplier Contract Management. While the vulnerability is in PeopleSoft Enterprise SCM Supplier Contract Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise SCM Supplier Contract Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege escalation to full application takeover in Oracle PeopleSoft Enterprise SCM Supplier Contract Management 9.2 (Security component) lets a low-privileged attacker with logon access to the hosting infrastructure compromise the module, with a scope change that can significantly impact additional connected products. The flaw carries an Oracle-assigned CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not in CISA KEV, though it is remediated in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

PeopleSoft Enterprise SCM Supplier Contract Management is a module of Oracle's PeopleSoft ERP suite used to author, manage, and enforce supplier contracts. The affected component is labeled 'Security', indicating the weakness lies in the application's authorization or access-control enforcement layer rather than in a specific parser or network protocol. Oracle assigned no CWE (CWE: N/A), so the precise root-cause class is unconfirmed, but the CVSS scope change (S:C) shows the vulnerable component and the impacted resources cross a trust/authorization boundary, meaning a compromise of this module can affect resources managed by other PeopleSoft components or the underlying platform. No CPE strings were supplied in the source data, so affected-product identification rests on Oracle's and ENISA EUVD's listing of version 9.2.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle remediates PeopleSoft issues through cumulative CPU patches and PeopleTools/PeopleSoft update images rather than a single tagged release, so no discrete fix version string is available beyond the CPU - apply the CPU patch level Oracle specifies for PeopleSoft SCM 9.2. As compensating controls until patching, tighten and audit who holds logon access to the hosting infrastructure, since AV:L/PR:L requires an authenticated local foothold: minimize the number of low-privileged application and OS accounts, enforce least privilege on the PeopleSoft application-server host, and enable enhanced logging on the Security component to detect anomalous authorization activity. These controls shrink the exploitable account population but do not close the underlying flaw, and restricting access may disrupt legitimate low-privilege users, so schedule the CPU patch promptly.