CVE-2026-61089: PeopleSoft SCM Auth Bypass Vulnerability

CVE-2026-61089 Overview

CVE-2026-61089 affects the Oracle PeopleSoft Enterprise SCM Inventory product, specifically its Security component. The flaw is present in supported version 9.2. An unauthenticated attacker with network access over HTTP can exploit this vulnerability without user interaction.

Successful exploitation grants unauthorized read access to all data accessible through PeopleSoft Enterprise SCM Inventory. Attackers can also perform unauthorized insert, update, or delete operations on a subset of that data. Oracle published the advisory as part of the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can access sensitive supply chain inventory data and modify inventory records without any user interaction.

Affected Products

Oracle PeopleSoft Enterprise SCM Inventory version 9.2
Oracle PeopleSoft (Supply Chain Management module)
Deployments exposing the SCM Inventory HTTP interface to untrusted networks

Discovery Timeline

2026-07-21 - CVE CVE-2026-61089 published to the National Vulnerability Database
2026-07-21 - Oracle Critical Patch Update advisory released
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-61089

Vulnerability Analysis

The vulnerability resides in the Security component of Oracle PeopleSoft Enterprise SCM Inventory. Oracle classifies the issue as easily exploitable and reachable over standard HTTP. No authentication or user interaction is required to trigger the flaw.

Exploitation yields high confidentiality impact and low integrity impact. An attacker gains complete read access to data managed by SCM Inventory, and partial write access allowing insert, update, or delete on selected records. Availability is not affected, so the module continues to serve legitimate users while attackers operate.

For organizations running PeopleSoft SCM, this exposes procurement records, stock levels, supplier data, warehouse assignments, and related business information. The Oracle CPU listing does not disclose the underlying weakness class, and Oracle has not published a CWE identifier.

Root Cause

Oracle has not released technical root cause details for CVE-2026-61089. The advisory attributes the flaw to the Security component of PeopleSoft Enterprise SCM Inventory 9.2. See the Oracle CPU July 2026 Security Alert for vendor guidance.

Attack Vector

The attack vector is network-based and reaches the vulnerable component through HTTP. An attacker sends a crafted request to an exposed PeopleSoft SCM Inventory endpoint. No credentials, tokens, or prior session establishment are required.

Because the flaw sits in the Security component, exploitation likely bypasses authentication or authorization checks that normally gate SCM Inventory data access. Public exploitation code has not been observed at the time of publication.

Detection Methods for CVE-2026-61089

Indicators of Compromise

Unauthenticated HTTP requests to PeopleSoft SCM Inventory URLs originating from external or unexpected internal sources
Anomalous read volume against inventory tables or SCM services outside standard business processes
Unexpected insert, update, or delete operations in SCM Inventory audit logs without a corresponding authenticated user session
Web server access logs showing repeated requests to SCM Inventory endpoints with missing or malformed session cookies

Detection Strategies

Enable and centralize PeopleSoft application server, web server, and database audit logs covering SCM Inventory transactions
Baseline normal SCM Inventory HTTP traffic patterns and alert on volume, source IP, and endpoint deviations
Correlate web tier requests with authenticated PeopleSoft sessions to flag unauthenticated data access attempts
Deploy a Web Application Firewall in front of PeopleSoft to inspect and log requests targeting the SCM Inventory Security component

Monitoring Recommendations

Ingest PeopleSoft, WebLogic, and database logs into a centralized SIEM for correlation and long-term retention
Monitor for outbound data transfers from PeopleSoft servers that exceed typical operational volume
Alert on unexpected modifications to inventory master data, stock quantities, or supplier records
Track access to PeopleSoft SCM URLs from IP ranges outside the corporate perimeter

How to Mitigate CVE-2026-61089

Immediate Actions Required

Apply the fixes shipped in the Oracle July 2026 Critical Patch Update for PeopleSoft Enterprise SCM Inventory 9.2
Inventory all PeopleSoft SCM Inventory deployments and confirm the running version and patch level
Restrict network exposure of PeopleSoft SCM Inventory HTTP endpoints to trusted networks and VPN users
Review SCM Inventory audit logs for signs of unauthorized data access since the CPU publication date

Patch Information

Oracle addresses CVE-2026-61089 in the July 2026 Critical Patch Update. Administrators should download the corresponding PeopleSoft update through My Oracle Support and follow the CPU release notes. Consult the Oracle CPU July 2026 Security Alert for the definitive patch matrix and installation guidance.

Workarounds

Place the PeopleSoft SCM Inventory web tier behind an authenticated reverse proxy or WAF that blocks unauthenticated requests to sensitive URIs
Enforce IP allowlisting on PeopleSoft SCM Inventory endpoints so only known application clients can connect
Increase logging granularity on the Security component and monitor for anomalous requests until patching is complete
Require VPN or zero trust network access for any user reaching PeopleSoft SCM Inventory interfaces

bash

# Example: restrict PeopleSoft SCM Inventory access at the web tier (nginx reverse proxy)
location /psp/ {
    allow 10.0.0.0/8;        # internal corporate range
    allow 192.168.10.0/24;   # PeopleSoft app clients
    deny  all;
    proxy_pass http://peoplesoft_backend;
}