CVE-2026-61201: Oracle PeopleSoft CRM RCE Vulnerability

CVE-2026-61201 Overview

CVE-2026-61201 is a critical vulnerability in the Oracle PeopleSoft Enterprise CRM Common Objects component. The flaw affects supported version 9.2.23 and allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation results in complete takeover of PeopleSoft Enterprise CRM Common Objects. The vulnerability carries a scope change, meaning attacks may significantly impact additional products beyond the vulnerable component. Oracle disclosed the issue in the July 2026 Critical Patch Update. The weakness is classified under [CWE-269] Improper Privilege Management.

Critical Impact
An unauthenticated network attacker can achieve full takeover of PeopleSoft Enterprise CRM Common Objects with confidentiality, integrity, and availability impact extending to adjacent components.

Affected Products

Oracle PeopleSoft Enterprise CRM Common Objects 9.2.23
Component: Common Objects
Deployments reachable over HTTP from untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-61201 published to NVD
2026-07-22 - Last updated in NVD database
July 2026 - Oracle releases fix in Critical Patch Update (CPU July 2026)

Technical Details for CVE-2026-61201

Vulnerability Analysis

The vulnerability resides in the Common Objects component of PeopleSoft Enterprise CRM. An unauthenticated remote attacker reaches the vulnerable code path through HTTP requests. Exploitation is rated difficult, requiring specific conditions to succeed. When those conditions are met, the attacker gains full control of the CRM Common Objects product.

The attack produces a scope change. This means the compromise crosses the security boundary of the initially vulnerable component and affects other PeopleSoft resources. Confidentiality, integrity, and availability are all impacted at the high level.

The underlying weakness maps to [CWE-269] Improper Privilege Management. The component grants privileges or trusts input in a way that permits an attacker to escalate control without valid credentials.

Root Cause

Improper privilege management in the Common Objects component allows an attacker to bypass authentication boundaries during HTTP request handling. The component does not correctly constrain the privileges associated with unauthenticated request contexts, permitting escalation into privileged operations that support product takeover.

Attack Vector

The attack vector is network based. An attacker sends crafted HTTP traffic to a reachable PeopleSoft Enterprise CRM instance running version 9.2.23. No prior authentication and no user interaction are required. Because exploitation conditions are constrained, weaponization requires attacker skill and environment-specific tuning. Refer to the Oracle Security Alert: CPU July 2026 for vendor technical detail.

Detection Methods for CVE-2026-61201

Indicators of Compromise

Unexpected administrative or configuration changes within PeopleSoft Enterprise CRM Common Objects
Anomalous HTTP requests targeting Common Objects endpoints from unauthenticated sources
New or modified PeopleSoft user accounts, roles, or permission lists without a change record
Outbound connections from PeopleSoft application servers to unfamiliar destinations

Detection Strategies

Inspect web server and application server logs for repeated malformed or unusual requests against CRM Common Objects URIs
Correlate HTTP 5xx spikes and unusual response sizes with subsequent privileged actions in PeopleSoft audit tables
Baseline normal traffic patterns to PeopleSoft endpoints and alert on deviations from unauthenticated sources

Monitoring Recommendations

Enable PeopleSoft audit logging for privilege, role, and permission changes and forward events to a central SIEM
Monitor authentication and session creation events for anomalies tied to Common Objects processing
Track file integrity on PeopleSoft application server directories and configuration stores

How to Mitigate CVE-2026-61201

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all PeopleSoft Enterprise CRM 9.2.23 deployments
Restrict inbound HTTP access to PeopleSoft interfaces to trusted networks and VPN users only
Audit PeopleSoft user, role, and permission list changes for the period preceding patch application
Rotate credentials and integration secrets on affected PeopleSoft components after patching

Patch Information

Oracle addressed CVE-2026-61201 in the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle Security Alert: CPU July 2026 and apply the CRM Common Objects fixes for version 9.2.23. Test patches in a staging environment before pushing to production PeopleSoft tiers.

Workarounds

Place PeopleSoft web tier behind an authenticating reverse proxy or web application firewall until patching completes
Block unauthenticated access to Common Objects endpoints at the network perimeter
Disable or restrict unused PeopleSoft CRM modules to reduce exposed attack surface

bash

# Example: restrict HTTP access to PeopleSoft web tier at the perimeter
iptables -A INPUT -p tcp --dport 8000 -s <trusted_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP