Peoplesoft In Memory Project Discovery EUVD-2026-47411

Oracle PeopleSoft In-Memory Project Discovery 9.2 contains a critical remote code execution vulnerability (CVSS 9.9) allowing low-privileged attackers over HTTP to achieve complete system takeover, with impact extending to integrated systems and related business applications. Organizations using PeopleSoft for HR and financial data management face immediate risk of total data compromise and operational outage. With no vendor patch currently available, this presents a severe threat to data integrity, regulatory compliance, and business continuity.

Within 24 hours, identify all Oracle PeopleSoft In-Memory Project Discovery 9.2 deployments and isolate them from untrusted networks, allowing access only from verified internal IP ranges. Within 7 days, deploy Web Application Firewall rules to restrict HTTP access to Project Discovery endpoints, implement enhanced logging and alerting for access attempts, and audit all low-privilege account permissions to Project Discovery. Within 30 days, apply the vendor patch immediately upon release from Oracle, or execute a planned migration to supported PeopleSoft versions unaffected by CVE-2026-61209; do not extend network controls as permanent remediation.

No vendor-released patch identified at time of analysis. Interim mitigations include strict network segmentation restricting Project Discovery 9.2 to internal-only access, Web Application Firewall rules limiting HTTP connections to authorized systems only, principle-of-least-privilege enforcement for accounts with Project Discovery access, real-time alerting on suspicious activity, and formal procedures to disable Project Discovery entirely if business operations permit.