CVE-2026-61207 Oracle Corporation CVE debrief

Who should care

Organizations using PeopleSoft Enterprise SCM eProcurement should prioritize patching this vulnerability to prevent potential attacks. The vulnerability has a high CVSS score and can allow unauthenticated attackers to compromise the system. Security teams and vulnerability management teams should review the affected scope and severity to determine the necessary actions. Operators and platform administrators should also be aware of the vulnerability and take necessary precautions.

Technical summary

The vulnerability is located in the Manage Requisition Status component of PeopleSoft Enterprise SCM eProcurement. It has a CVSS score of 9.3 and can allow unauthenticated attackers with network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM eProcurement accessible data, as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM eProcurement accessible data. The vulnerability is easily exploitable and has a high impact on confidentiality and integrity.

Defensive priority

High

Recommended defensive actions

• Apply the patch provided by the vendor
• Conduct a thorough inventory check to identify affected systems
• Implement compensating controls to monitor and detect potential attacks
• Restrict access to the affected component
• Monitor for suspicious activity
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-21T22:18:52.447Z and was last modified on 2026-07-22T19:17:08.430Z. The NVD entry is currently under review. The vulnerability affects PeopleSoft Enterprise SCM eProcurement product of Oracle PeopleSoft, specifically the Manage Requisition Status component. The CVSS score of 9.3 indicates a critical vulnerability. The evidence provided is limited, and further verification is needed to confirm the affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.