CVE-2026-61086: PeopleSoft SCM Auth Bypass Vulnerability

CVE-2026-61086 Overview

CVE-2026-61086 affects Oracle PeopleSoft Enterprise Supply Chain Management (SCM) Order Management version 9.2. The vulnerability resides in the Security component and allows an unauthenticated remote attacker to compromise the application over HTTPS. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Successful exploitation results in unauthorized access to critical data or complete access to all data accessible through PeopleSoft Enterprise SCM Order Management. The flaw requires no user interaction and is described by Oracle as easily exploitable.

Critical Impact
An unauthenticated network attacker can read all data accessible to the PeopleSoft SCM Order Management application, including sensitive supply chain, customer, and order information.

Affected Products

Oracle PeopleSoft Enterprise SCM Order Management 9.2
Deployments exposed via HTTPS to untrusted networks
Environments not covered by the July 2026 Oracle Critical Patch Update

Discovery Timeline

2026-07-21 - CVE-2026-61086 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-61086

Vulnerability Analysis

The vulnerability sits in the Security component of PeopleSoft Enterprise SCM Order Management 9.2. Oracle categorizes the issue as an unauthenticated confidentiality exposure reachable over the network via HTTPS. The advisory reports impact on confidentiality only, with no integrity or availability effects.

An attacker sends crafted HTTPS requests to the exposed PeopleSoft application. No credentials, privileges, or user interaction are required. The scope remains unchanged, meaning the attacker operates within the vulnerable component's authorization boundary and reads data available to that component.

Because SCM Order Management stores purchase orders, pricing, customer identifiers, and supplier information, disclosure can extend to regulated business data. The EPSS probability is 0.398% as of 2026-07-23, but the low authentication barrier makes opportunistic scanning likely.

Root Cause

Oracle has not published root cause details in the public advisory. The Critical Patch Update entry attributes the flaw to the Security component of PeopleSoft SCM Order Management. Based on the CVSS metrics, the defect enables information disclosure without any authentication or privilege check. Refer to the Oracle Critical Patch Update - July 2026 for vendor guidance.

Attack Vector

The attack vector is network-based over HTTPS. An attacker with reachability to the PeopleSoft web tier issues requests that return data the requester should not access. The advisory does not disclose the specific endpoint or parameter involved.

No public proof-of-concept exploit is available at the time of publication. No entries exist on CISA's Known Exploited Vulnerabilities catalog or in Exploit-DB.

Detection Methods for CVE-2026-61086

Indicators of Compromise

Unauthenticated HTTPS requests to PeopleSoft SCM Order Management endpoints returning large or unexpected response bodies
Anomalous request patterns targeting Security component URLs from external IP ranges
Access log entries showing successful responses to requests lacking valid session cookies or authentication tokens

Detection Strategies

Review PeopleSoft webserver access logs for high-volume requests from single source addresses without corresponding authenticated sessions
Correlate PeopleSoft application server logs with network flow data to identify data-heavy responses to unauthenticated clients
Deploy web application firewall rules that alert on unauthenticated access to sensitive PeopleSoft URIs

Monitoring Recommendations

Enable verbose audit logging on the PeopleSoft Enterprise SCM Order Management web and application tiers
Forward PeopleSoft, WebLogic, and Tuxedo logs to a centralized SIEM for retention and correlation
Baseline normal query patterns and alert on deviations in request volume, response size, or endpoint distribution

How to Mitigate CVE-2026-61086

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all PeopleSoft Enterprise SCM Order Management 9.2 deployments
Restrict network access to the PeopleSoft web tier so that only trusted networks can reach HTTPS endpoints
Audit recent access logs for signs of unauthenticated data retrieval prior to patching
Rotate credentials or tokens that may have been exposed through the affected application

Patch Information

Oracle addressed CVE-2026-61086 in the Oracle Critical Patch Update - July 2026. Administrators must apply the PeopleSoft SCM Order Management patch bundle for version 9.2 through the standard Oracle patching process. Verify patch installation by checking application version metadata after deployment.

Workarounds

Place the PeopleSoft web tier behind a reverse proxy or WAF that enforces authentication before requests reach the application
Limit HTTPS exposure of PeopleSoft SCM Order Management to VPN or internal network ranges until patching completes
Disable or firewall any non-essential Security component endpoints identified in Oracle documentation

bash

# Example: restrict PeopleSoft HTTPS access to trusted subnets via iptables
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP