CVE-2026-61077: PeopleSoft SCM Auth Bypass Vulnerability

CVE-2026-61077 Overview

CVE-2026-61077 affects the Oracle PeopleSoft Enterprise SCM Mobile Inventory Management product, specifically its Security component. The flaw exists in supported version 9.2 and allows a low-privileged attacker with local logon access to the underlying infrastructure to compromise the application. Exploitation is difficult but results in a scope change, meaning attacks may impact additional products beyond the vulnerable component. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, as well as full read access to all data accessible through PeopleSoft Enterprise SCM Mobile Inventory Management.

Critical Impact
A local, low-privileged attacker can gain complete read and write access to data within PeopleSoft Enterprise SCM Mobile Inventory Management, with potential impact to adjacent products through scope change.

Affected Products

Oracle PeopleSoft Enterprise SCM Mobile Inventory Management 9.2
Component: Security
Adjacent PeopleSoft products may be affected due to scope change

Discovery Timeline

2026-07-21 - CVE-2026-61077 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update, July 2026

Technical Details for CVE-2026-61077

Vulnerability Analysis

The vulnerability resides in the Security component of Oracle PeopleSoft Enterprise SCM Mobile Inventory Management 9.2. Oracle categorizes exploitation as difficult, requiring local access to the infrastructure hosting the application and existing low-privileged credentials. The attack does not require user interaction.

The defining characteristic of this flaw is the scope change. An attacker exploiting the weakness in the Mobile Inventory Management component can pivot into resources managed by other PeopleSoft products sharing the same environment. Confidentiality and integrity are fully compromised, while availability is not affected.

Oracle has not published detailed root cause information, which is consistent with Oracle Critical Patch Update disclosure practice. No Common Weakness Enumeration (CWE) identifier has been assigned in the NVD record. The Exploit Prediction Scoring System places the near-term probability of observed exploitation at 0.12%.

Root Cause

Oracle attributes the flaw to the Security component of PeopleSoft Enterprise SCM Mobile Inventory Management. The vendor advisory does not disclose the specific defective function, code path, or configuration. The scope change indicated by Oracle suggests that the compromised component holds authority or trust that extends beyond its own security boundary, allowing an attacker to reach resources controlled by a different security authority.

Attack Vector

An attacker must first obtain local logon access to the server infrastructure where PeopleSoft Enterprise SCM Mobile Inventory Management runs and hold at least low-privileged credentials on that system. From this position, the attacker executes an attack sequence Oracle characterizes as high complexity, meaning success depends on conditions outside the attacker's direct control. No user interaction is required. Successful exploitation delivers full read and write access to application data and enables lateral impact into adjacent PeopleSoft products.

No public proof-of-concept exploit code has been published for CVE-2026-61077. See the Oracle Security Alert July 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-61077

Indicators of Compromise

Unexpected authentication events for low-privileged local accounts on servers hosting PeopleSoft Enterprise SCM Mobile Inventory Management 9.2
Anomalous read or write activity against Mobile Inventory Management data tables, particularly bulk modification or deletion of inventory records
Cross-product access patterns where identities scoped to Mobile Inventory Management touch data owned by other PeopleSoft modules
Unscheduled changes to security metadata, roles, or permission assignments within the PeopleSoft environment

Detection Strategies

Enable and centralize PeopleSoft application, database, and OS audit logs, then baseline normal access patterns for Mobile Inventory Management service accounts
Alert on any local interactive or remote shell logon to PeopleSoft application-tier hosts by accounts that should only authenticate to the application layer
Correlate database query volume and privilege use against expected batch and user workflows to surface scope-crossing data access

Monitoring Recommendations

Forward PeopleSoft, WebLogic, and Tweedle process logs to a centralized SIEM with retention sufficient to investigate multi-stage local attacks
Monitor file integrity on PeopleSoft application server binaries, configuration files, and security metadata stores
Track privilege changes and role assignments in the PeopleSoft security tables and alert on out-of-window modifications

How to Mitigate CVE-2026-61077

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fixes for PeopleSoft Enterprise SCM Mobile Inventory Management 9.2 as published in the Oracle Security Alert July 2026
Inventory all hosts running PeopleSoft Enterprise SCM Mobile Inventory Management 9.2 and confirm patch coverage
Review and reduce the population of accounts with local logon rights to PeopleSoft application-tier servers
Rotate credentials for service accounts and low-privileged users on the affected infrastructure after patching

Patch Information

Oracle addressed CVE-2026-61077 in the July 2026 Critical Patch Update. Administrators should download and apply the applicable patch for PeopleSoft Enterprise SCM Mobile Inventory Management 9.2 following Oracle's documented CPU installation procedures. Refer to the Oracle Critical Patch Update Advisory - July 2026 for the full patch matrix and prerequisites.

Workarounds

Restrict local logon on PeopleSoft servers to a minimal, audited set of administrative accounts until patching is complete
Segment PeopleSoft infrastructure so that a compromised Mobile Inventory Management host cannot directly reach other PeopleSoft product data stores
Enforce multi-factor authentication and jump-host access for any interactive login to PeopleSoft application-tier systems
Increase audit logging verbosity on the affected hosts to shorten investigation time if exploitation is suspected

bash

# Example: restrict interactive logon on Linux PeopleSoft hosts to an allow-list group
# 1. Create a dedicated admin group
sudo groupadd psft-admins

# 2. Add authorized administrators
sudo usermod -aG psft-admins <admin-user>

# 3. Restrict SSH access via /etc/ssh/sshd_config
echo "AllowGroups psft-admins" | sudo tee -a /etc/ssh/sshd_config
sudo systemctl restart sshd

# 4. Enable process and authentication auditing
sudo auditctl -w /var/log/auth.log -p wa -k psft_auth
sudo auditctl -a always,exit -F arch=b64 -S execve -F euid=0 -k psft_root_exec