CVE-2026-61205: PeopleSoft SCM Auth Bypass Vulnerability

CVE-2026-61205 Overview

CVE-2026-61205 is an improper access control vulnerability [CWE-284] affecting Oracle PeopleSoft Enterprise Supply Chain Management (SCM) Purchasing version 9.2. The flaw resides in the Purchasing component and can be exploited by an unauthenticated attacker with network access over HTTP. Successful exploitation grants unauthorized create, delete, or modify access to critical Purchasing data, along with unauthorized read access to a subset of application data. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
An unauthenticated remote attacker can tamper with all PeopleSoft SCM Purchasing accessible data and read a subset of application data over HTTP without user interaction.

Affected Products

Oracle PeopleSoft Enterprise SCM Purchasing 9.2
Component: Purchasing
Protocol: HTTP

Discovery Timeline

2026-07-21 - CVE-2026-61205 published to NVD
2026-07-22 - Last updated in NVD database
July 2026 - Oracle releases fix in the July 2026 Critical Patch Update

Technical Details for CVE-2026-61205

Vulnerability Analysis

CVE-2026-61205 is an improper access control weakness [CWE-284] in the Purchasing component of Oracle PeopleSoft Enterprise SCM. The vulnerability allows an attacker to reach protected functionality through HTTP requests without authentication. Oracle classifies the flaw as easily exploitable, meaning no specialized conditions or elevated privileges are required.

The primary impact is on data integrity. An attacker can create, delete, or modify records across all data accessible to the Purchasing application. A secondary impact is limited unauthorized read access to a subset of application data. Availability of the application is not directly affected.

Exploitation targets business-critical procurement workflows, including purchase orders, supplier records, receipts, and requisitions. Manipulation of these records can enable financial fraud, supplier redirection, or downstream supply chain disruption.

Root Cause

The vulnerability stems from missing or insufficient authorization checks in the Purchasing module. Access-restricted operations are reachable without validating the requester's identity or entitlement. Under [CWE-284], the application fails to enforce the principle that sensitive operations require authenticated, authorized callers.

Attack Vector

The attack is executed remotely over the network using HTTP. No credentials, user interaction, or prior access to the environment are required. An attacker with reachability to the PeopleSoft web tier can send crafted HTTP requests to the vulnerable endpoints and manipulate Purchasing data directly.

Refer to the Oracle July 2026 Security Alert for vendor technical details. No verified public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-61205

Indicators of Compromise

Unauthenticated HTTP requests to PeopleSoft Purchasing endpoints originating from unexpected external IP addresses
Unexpected create, update, or delete operations on purchase orders, requisitions, or supplier master data outside change windows
PeopleSoft application server logs showing anonymous or unauthenticated sessions invoking Purchasing component actions
Newly created or modified supplier bank or remit-to records lacking a corresponding approval trail

Detection Strategies

Correlate PeopleSoft web server access logs with application-layer audit records to identify data changes that lack an authenticated user context
Baseline normal Purchasing transaction volumes and alert on anomalous spikes in create or delete operations
Deploy web application firewall rules to flag HTTP requests hitting Purchasing URLs without valid session cookies or authentication headers

Monitoring Recommendations

Forward PeopleSoft application, web, and database audit logs to a centralized SIEM for correlation with network telemetry
Enable PeopleSoft audit trails on Purchasing tables to capture row-level changes with timestamps and originating IPs
Monitor egress traffic from PeopleSoft servers to detect data exfiltration attempts following successful exploitation

How to Mitigate CVE-2026-61205

Immediate Actions Required

Apply the fixes provided in the Oracle July 2026 Critical Patch Update to PeopleSoft Enterprise SCM Purchasing 9.2
Restrict inbound HTTP access to PeopleSoft web tiers to trusted networks and authenticated corporate VPN ranges
Review recent Purchasing data changes for unauthorized modifications, prioritizing supplier records and payment details

Patch Information

Oracle released the official fix as part of the July 2026 Critical Patch Update. Administrators should identify the applicable PeopleTools and PeopleSoft SCM patch bundle for version 9.2 and apply it following Oracle's documented update procedure. Test in a non-production environment before promoting to production.

Workarounds

Place the PeopleSoft web tier behind an authenticating reverse proxy or web application firewall until patches are applied
Block direct internet exposure of PeopleSoft Purchasing URLs and restrict access to VPN-connected users
Increase audit logging verbosity on Purchasing components and enable real-time alerts on high-risk transactions

bash

# Configuration example: restrict Purchasing endpoints at the reverse proxy
# Consult Oracle documentation for the authoritative remediation steps
location /psp/ {
    allow 10.0.0.0/8;      # corporate network
    allow 192.168.0.0/16;  # VPN pool
    deny all;
    proxy_pass http://peoplesoft-web-tier;
}