What is the CVSS score of EUVD-2026-47299?

EUVD-2026-47299 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle PeopleSoft are affected by EUVD-2026-47299?

Oracle PeopleSoft Enterprise SCM Manufacturing 9.2 contains a critical authentication bypass vulnerability allowing remote attackers to access sensitive supply-chain, production planning, and…

How to fix or mitigate EUVD-2026-47299?

Within 24 hours, inventory all Oracle PeopleSoft Enterprise SCM Manufacturing 9.2 instances and immediately restrict network access to authorized internal personnel only; scan your perimeter for internet-exposed systems and firewall any external access paths. Within 7 days, enable comprehensive audit logging on all affected systems to detect unauthorized data access and review historical access logs from the past 30 days for evidence of exploitation. Within 30 days, contact Oracle support to initiate upgrade planning to a patched PeopleSoft Enterprise version or evaluate alternative supply-chain management platforms; maintain strict network segmentation isolating SCM 9.2 systems from external networks and untrusted internal subnets pending patch availability.

Oracle PeopleSoft EUVD-2026-47299

| CVE-2026-61088 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-wc3g-2v7q-cjqx

Authentication Bypass Oracle Peoplesoft Enterprise Scm Manufacturing

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote HTTP access with low complexity and no user interaction yields PR:N/AC:L/AV:N; impact is data disclosure only, so C:H with I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:54 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise SCM Manufacturing product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Manufacturing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Manufacturing accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle PeopleSoft Enterprise SCM Manufacturing 9.2 (Security component) allows a remote, unauthenticated attacker with HTTP network access to read critical manufacturing and supply-chain data. Oracle rates the flaw as easily exploitable with a CVSS 3.1 base score of 7.5 (confidentiality-only impact), and vendor tagging associates it with an authentication-bypass class of issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

PeopleSoft Enterprise SCM is Oracle's supply-chain management ERP suite; the Manufacturing module handles production planning, BOMs, work orders and shop-floor data, exposed through the web-facing PeopleSoft Internet Architecture (PIA) over HTTP. The defect resides in the product's Security component, and Oracle's own tagging labels it an Authentication Bypass, implying a flaw in access-control or session handling that lets requests reach protected data without valid credentials. The NVD entry carries no CWE (CWE: N/A), so the precise weakness class is not formally categorized, but the confidentiality-only impact combined with the auth-bypass tag points to a broken-access-control / improper-authentication root cause rather than memory corruption.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, which addresses this issue; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch bundle applicable to PeopleSoft Enterprise SCM Manufacturing 9.2 (Patch available per vendor advisory - an exact fix version string was not provided in the source data, so validate the specific PeopleTools/SCM patch number in the CPU matrix). Until patched, reduce exposure by restricting network reachability of the PeopleSoft Internet Architecture (PIA) web endpoints to trusted networks or VPN, placing the Manufacturing servlets behind a WAF or reverse proxy that enforces authentication, and monitoring HTTP access logs for anomalous unauthenticated requests to SCM Manufacturing pages; note that network restrictions may impede legitimate remote or supplier access and should be scoped accordingly.