Peoplesoft Enterprise Scm Inventory EUVD-2026-47296

Oracle PeopleSoft Enterprise SCM Inventory 9.2 contains an authentication bypass vulnerability (CVE-2026-61085, CVSS 7.5) that allows remote, unauthenticated attackers to access all sensitive supply chain management data without credentials or user interaction. With no vendor patch currently available, organizations running affected versions face immediate risk of unauthorized disclosure of procurement, inventory, and supplier information. This represents a critical gap in supply chain data protection requiring urgent interim mitigation.

Within 24 hours, conduct an asset inventory of all Oracle PeopleSoft SCM Inventory 9.2 instances and assess network exposure; immediately restrict network access to trusted internal networks only and require VPN authentication for any remote access. Within 7 days, deploy Web Application Firewall rules to filter requests targeting CVE-2026-61085, enable comprehensive audit logging of all data access and administrative actions, and implement network segmentation to isolate SCM Inventory systems from general production networks. Within 30 days, monitor the Oracle July 2026 Critical Patch Update for the official fix; develop a rapid deployment procedure to apply the patch within 48 hours of vendor release and continue interim monitoring and access controls until patched.

No vendor-released patch identified at time of analysis. Implement network access controls restricting SCM Inventory to authorized internal networks only; enforce VPN authentication for all remote access; deploy WAF rules to block exploit attempts; enable detailed audit logging of all database queries and data access; implement IP whitelisting for legitimate client systems; monitor access logs for anomalous data retrieval; and consider disabling non-critical application features if risk assessment deems exposure critical.