CVE-2026-61059: PeopleSoft SCM Auth Bypass Vulnerability

CVE-2026-61059 Overview

CVE-2026-61059 is a critical vulnerability in the Oracle PeopleSoft Enterprise SCM Order Management product, specifically within the Security component. The affected supported version is 9.2. Unauthenticated attackers with network access via HTTP can compromise the application without user interaction. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, and complete read access to all data accessible through PeopleSoft Enterprise SCM Order Management. Oracle disclosed the flaw in its July 2026 Critical Patch Update advisory.

Critical Impact
Remote, unauthenticated attackers can gain full read and write access to all data accessible through PeopleSoft Enterprise SCM Order Management over HTTP.

Affected Products

Oracle PeopleSoft Enterprise SCM Order Management 9.2
Component: Security
Deployments exposing PeopleSoft SCM Order Management HTTP interfaces to untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-61059 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-61059

Vulnerability Analysis

The vulnerability resides in the Security component of Oracle PeopleSoft Enterprise SCM Order Management. An attacker requires only network reachability to the HTTP interface. No authentication, privileges, or user interaction are needed. Attack complexity is low, and the scope remains unchanged. Confidentiality and integrity impacts are both high, while availability is not impacted.

The flaw enables unauthenticated remote actors to read, create, modify, or delete data managed by the module. In supply chain and order management deployments, this data typically includes purchase orders, pricing, vendor information, and customer records. Tampering with these records can disrupt fulfillment workflows and downstream financial reconciliation.

Root Cause

Oracle has not published low-level technical details. Based on the advisory metadata, the defect resides in the Security component and permits an unauthenticated HTTP request path to bypass access controls governing SCM Order Management data operations. Historically, similar PeopleSoft advisories have involved authentication bypass, broken access control, or unsafe deserialization in web-facing servlets.

Attack Vector

Exploitation is performed remotely over HTTP against an exposed PeopleSoft Internet Architecture (PIA) endpoint. The attacker sends crafted requests to the SCM Order Management application, which processes them without enforcing required authentication or authorization checks. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, any network-reachable instance is at risk, including those behind reverse proxies that do not add authentication of their own.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Oracle Critical Patch Update Advisory - July 2026 for authoritative technical guidance.

Detection Methods for CVE-2026-61059

Indicators of Compromise

Unauthenticated HTTP requests to PeopleSoft Order Management URIs returning success status codes for data-modifying operations
Unexpected creation, modification, or deletion events on PS_ORDER_* and related SCM tables outside of business hours or without corresponding user session records
Access log entries showing requests from unknown external IP addresses to /psp/ or /psc/ PeopleSoft servlet paths without prior authentication cookies
Anomalous outbound data transfers from PeopleSoft application servers following unauthenticated inbound HTTP traffic

Detection Strategies

Correlate PeopleSoft application server access logs with database audit logs to identify data changes lacking an authenticated user context
Deploy web application firewall rules that alert on requests to SCM Order Management endpoints without valid session tokens
Monitor for HTTP request patterns targeting known PeopleSoft servlets from IP addresses outside authorized user ranges
Baseline normal Order Management transaction volume and alert on statistical deviations that may indicate mass data exfiltration

Monitoring Recommendations

Enable verbose PeopleSoft PIA and application server logging, and forward events to a centralized SIEM for retention and correlation
Enable database-level auditing on Order Management tables to capture SELECT, INSERT, UPDATE, and DELETE operations
Alert on any administrative or bulk operations executed against SCM data outside change-management windows

How to Mitigate CVE-2026-61059

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for PeopleSoft Enterprise SCM Order Management 9.2 without delay
Inventory all internet-exposed PeopleSoft instances and restrict HTTP access to trusted networks until patched
Review Order Management data for unauthorized changes since the CVE publication date of 2026-07-21
Rotate credentials and session tokens on affected systems if compromise is suspected

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators must apply the update to Oracle PeopleSoft Enterprise SCM Order Management version 9.2. Full patch details, prerequisites, and installation guidance are available in the Oracle Critical Patch Update Advisory - July 2026.

Workarounds

Restrict HTTP and HTTPS access to PeopleSoft PIA endpoints using network ACLs, VPN, or zero-trust access proxies until patches are applied
Place a web application firewall in front of PeopleSoft with rules that block unauthenticated requests to SCM Order Management servlets
Disable or firewall off any unused PeopleSoft modules and public-facing interfaces to reduce attack surface
Increase logging verbosity and database auditing to accelerate identification of exploitation attempts during the mitigation window

bash

# Example: restrict PeopleSoft PIA HTTP access to trusted subnet using iptables
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
iptables -A INPUT -p tcp --dport 8443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP