CVE-2026-61209 Oracle Corporation CVE debrief

Who should care

Organizations using PeopleSoft In-Memory Project Discovery version 9.2 should prioritize patching this vulnerability to prevent potential attacks. The vulnerability's high CVSS score and the potential for significant impact on additional products make it a critical concern for affected organizations. Operators, platform administrators, vulnerability management teams, and security teams should be aware of this vulnerability and take necessary actions.

Technical summary

The vulnerability in PeopleSoft In-Memory Project Discovery (component: Project Discovery) of Oracle PeopleSoft allows a low-privileged attacker with network access via HTTP to compromise PeopleSoft In-Memory Project Discovery. The CVSS 3.1 Base Score is 9.9, indicating a critical severity level. The vulnerability's CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). This vulnerability can be exploited easily, and successful attacks can result in the takeover of PeopleSoft In-Memory Project Discovery. The supported version affected is 9.2.

Defensive priority

High

Recommended defensive actions

• Apply the patch provided by Oracle as soon as possible
• Restrict network access to PeopleSoft In-Memory Project Discovery
• Monitor for suspicious activity
• Review and update access controls
• Consider implementing compensating controls
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-21T22:18:52.560Z and was last modified on 2026-07-22T19:17:08.547Z. The NVD entry is currently in the 'Received' status. The vulnerability details are based on the information provided by the CVE.org and NVD. The source grounding indicates that the information is based on official sources, but there may be limitations in the evidence available.

Official resources