What is the CVSS score of EUVD-2026-47288?

EUVD-2026-47288 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Oracle PeopleSoft are affected by EUVD-2026-47288?

Oracle PeopleSoft Enterprise SCM Mobile Inventory Management 9.2 contains a privilege-escalation vulnerability (CVE-2026-61077) allowing authenticated attackers with local infrastructure access to…

How to fix or mitigate EUVD-2026-47288?

Within 24 hours, inventory all systems running PeopleSoft Enterprise SCM Mobile Inventory Management 9.2 and audit who currently has local logon access to the hosting infrastructure; document active user privilege assignments and review access logs for anomalies. Within 7 days, restrict local infrastructure access to only authorized system administrators, enable enhanced audit logging for all database modifications within the SCM application, and review all active application user accounts to disable unnecessary administrative privileges. Within 30 days, implement role-based access controls limiting application user permissions to job-specific functions, conduct a comprehensive data integrity audit of sensitive supply chain records to detect any unauthorized changes, and establish a support plan with Oracle to obtain patches when available.

Oracle PeopleSoft EUVD-2026-47288

| CVE-2026-61077 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-gmj5-gxjc-cmm3

Authentication Bypass Oracle Peoplesoft Enterprise Scm Mobile Inventory Management

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

7.5 HIGH

Requires local logon (AV:L) with an existing low-privileged account (PR:L) and is hard to trigger (AC:H); scope change (S:C) reaches other products with full confidentiality and integrity loss but no availability impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:57 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise SCM Mobile Inventory Management product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise SCM Mobile Inventory Management executes to compromise PeopleSoft Enterprise SCM Mobile Inventory Management. While the vulnerability is in PeopleSoft Enterprise SCM Mobile Inventory Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise SCM Mobile Inventory Management accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Mobile Inventory Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Privilege-scoped data compromise in Oracle PeopleSoft Enterprise SCM Mobile Inventory Management 9.2 (Security component) allows a low-privileged, authenticated attacker with local logon to the hosting infrastructure to read, create, delete, or modify all data accessible to the application, with a scope change that can significantly impact additional connected PeopleSoft products. Oracle rates this CVSS 3.1 7.5, but exploitation is explicitly rated difficult (AC:H), and there is no public exploit identified at time of analysis nor CISA KEV listing. The Oracle-supplied 'Authentication Bypass' tag suggests the flaw may let an attacker escalate beyond their assigned authorization boundary, though Oracle's terse advisory does not detail the mechanism.

Technical ContextAI

The affected technology is Oracle PeopleSoft Enterprise Supply Chain Management (SCM), specifically the Mobile Inventory Management module at version 9.2, a component of the broader PeopleSoft ERP suite typically deployed on PeopleTools application/web server tiers backed by an Oracle Database. The flaw resides in the 'Security' component, and Oracle's own tag labels it an Authentication Bypass, implying a weakness in how the application enforces authorization or session/identity checks (root-cause class akin to CWE-287 Improper Authentication or CWE-863 Incorrect Authorization). No formal CWE was assigned by NVD, and no CPE strings were provided in the intelligence, so exact affected configuration is bounded only by Oracle's statement that supported version 9.2 is affected. The CVSS scope change (S:C) indicates the vulnerable component and the impacted component differ - a compromise of the Mobile Inventory module can reach data and functions in other PeopleSoft products sharing the same environment.

RemediationAI

Apply the fix delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory) documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle CPUs are cumulative, so applying the current PeopleSoft/PeopleTools CPU patch set for the 9.2 line remediates this issue - no standalone fix version was published in the intelligence, so consult the CPU advisory matrix for the exact PeopleTools/SCM patch ID for your deployment. As compensating controls until patched: restrict and audit local/interactive logon to the PeopleSoft application and web server hosts to trusted administrators only (reduces the AV:L prerequisite, at the cost of tighter operational access), minimize the number of low-privileged application accounts and review their role assignments in the Security component (limits the PR:L foothold, but may disrupt legitimate mobile inventory users), and enable enhanced logging/monitoring of unauthorized data access and authorization changes across co-resident PeopleSoft modules to detect scope-crossing abuse. Do not expose PeopleSoft application/host shells to untrusted network segments.