Peoplesoft Enterprise Scm Order Management
Monthly
Unauthorized data disclosure in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) allows a remote, unauthenticated attacker with HTTPS network access to read critical or all data accessible to the application. Rated CVSS 3.1 7.5 (confidentiality-only), the flaw is described by Oracle as easily exploitable and is tagged as an authentication bypass. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) lets remote attackers read, create, modify, or delete all data accessible to the application over HTTP. Tagged as an authentication bypass, the flaw carries a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact but no availability impact, and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle PeopleSoft Enterprise SCM Order Management 9.2 is possible for any low-privileged user who can log on to the infrastructure where the application runs, via a flaw in its Security component. A successful attack yields complete compromise of confidentiality, integrity, and availability of the Order Management module. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) allows a remote, unauthenticated attacker with HTTPS network access to read critical or all data accessible to the application. Rated CVSS 3.1 7.5 (confidentiality-only), the flaw is described by Oracle as easily exploitable and is tagged as an authentication bypass. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise SCM Order Management 9.2 (Security component) lets remote attackers read, create, modify, or delete all data accessible to the application over HTTP. Tagged as an authentication bypass, the flaw carries a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact but no availability impact, and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle PeopleSoft Enterprise SCM Order Management 9.2 is possible for any low-privileged user who can log on to the infrastructure where the application runs, via a flaw in its Security component. A successful attack yields complete compromise of confidentiality, integrity, and availability of the Order Management module. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update.