CVE-2026-61085: PeopleSoft SCM Auth Bypass Vulnerability

CVE-2026-61085 Overview

CVE-2026-61085 is a high-severity vulnerability in the Oracle PeopleSoft Enterprise SCM Inventory product, specifically within the Security component. The affected version is PeopleSoft 9.2. An unauthenticated attacker with network access via HTTPS can exploit this flaw to compromise confidentiality of the application. Successful exploitation results in unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Inventory accessible data. The vulnerability is easily exploitable and requires no user interaction or prior authentication.

Critical Impact
Unauthenticated remote attackers can read all data accessible through PeopleSoft Enterprise SCM Inventory over HTTPS, exposing sensitive supply chain and inventory records.

Affected Products

Oracle PeopleSoft Enterprise SCM Inventory 9.2
Component: Security
Deployments exposing PeopleSoft over HTTPS to untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-61085 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update advisory

Technical Details for CVE-2026-61085

Vulnerability Analysis

The vulnerability resides in the Security component of Oracle PeopleSoft Enterprise SCM Inventory 9.2. It allows a network-based attacker to reach sensitive functionality without providing credentials. The CVSS vector indicates confidentiality impact only, meaning the flaw exposes data but does not directly enable modification or service disruption. Because exploitation occurs over standard HTTPS, attackers can blend malicious requests with normal application traffic. Oracle has not published component-level internals, but the advisory confirms low attack complexity and unauthenticated access as prerequisites.

Root Cause

The underlying issue is an authorization or access control weakness in a security-related module of PeopleSoft SCM Inventory. Requests that should require authenticated, authorized sessions instead return protected inventory data. This class of defect commonly maps to broken access control (missing authorization checks on server-side endpoints). Oracle's July 2026 Critical Patch Update lists the fix without disclosing the specific endpoint or parameter.

Attack Vector

An attacker sends crafted HTTPS requests directly to an exposed PeopleSoft Enterprise SCM Inventory instance. No credentials, tokens, or user interaction are required. The attacker enumerates or invokes vulnerable endpoints to retrieve inventory, supplier, and related supply chain records. Internet-exposed PeopleSoft portals face the highest risk, though attackers with foothold access to internal networks can reach internal deployments equally well.

No public proof-of-concept exploit code is available at this time. Refer to the Oracle Security Alert July 2026 for vendor-provided technical detail.

Detection Methods for CVE-2026-61085

Indicators of Compromise

Unauthenticated HTTPS requests to PeopleSoft SCM Inventory endpoints returning HTTP 200 responses with data payloads
Large or repeated response bodies from Inventory-related URIs originating from a single external IP
Access logs showing requests to security or inventory servlets without a preceding authenticated session identifier

Detection Strategies

Correlate PeopleSoft application server logs and web tier logs to identify request paths that bypass session validation
Baseline normal authenticated request patterns and alert on anonymous access to Inventory endpoints
Deploy web application firewall rules that flag high-volume enumeration of SCM Inventory URIs

Monitoring Recommendations

Enable verbose access logging on the PeopleSoft Internet Architecture (PIA) web server tier
Forward PeopleSoft, WebLogic, and load balancer logs to a central SIEM for correlation
Monitor egress data volumes from PeopleSoft hosts for anomalous spikes indicating bulk data retrieval

How to Mitigate CVE-2026-61085

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all PeopleSoft Enterprise SCM Inventory 9.2 environments
Inventory internet-exposed PeopleSoft instances and place them behind authenticated reverse proxies or VPNs until patched
Review web tier and application logs for suspicious unauthenticated requests dating back before patch deployment
Rotate any credentials, API tokens, or integration secrets that may have been exposed through inventory data

Patch Information

Oracle addressed CVE-2026-61085 in the July 2026 Critical Patch Update. Administrators should review the Oracle Security Alert July 2026 for patch identifiers, prerequisites, and installation guidance specific to PeopleSoft Enterprise SCM Inventory 9.2. Apply the patch during the next available maintenance window and validate application functionality in a non-production tier first.

Workarounds

Restrict network access to PeopleSoft SCM Inventory URIs using firewall or reverse proxy allow lists
Enforce authentication at the reverse proxy layer for all Inventory-related paths
Disable or block public exposure of non-essential PeopleSoft services until patching completes

bash

# Example nginx rule restricting unauthenticated access to Inventory paths
location /psp/ {
    satisfy all;
    allow 10.0.0.0/8;
    deny all;
    auth_request /_auth;
    proxy_pass https://peoplesoft-backend;
}