CVE-2026-61207: PeopleSoft SCM Auth Bypass Vulnerability

CVE-2026-61207 Overview

CVE-2026-61207 is an access control vulnerability [CWE-284] in the Manage Requisition Status component of Oracle PeopleSoft Enterprise SCM eProcurement version 9.2. An unauthenticated remote attacker with HTTP network access can exploit this weakness without user interaction. Successful exploitation grants unauthorized access to critical data and permits limited unauthorized modification of data accessible through the application. The flaw carries a scope change, meaning exploitation can impact components beyond the vulnerable module. Oracle disclosed the issue in its July 2026 Critical Patch Update.

Critical Impact
Unauthenticated attackers can compromise Oracle PeopleSoft Enterprise SCM eProcurement over the network and access sensitive procurement data across integrated PeopleSoft components.

Affected Products

Oracle PeopleSoft Enterprise SCM eProcurement 9.2
Component: Manage Requisition Status
Related PeopleSoft modules affected via scope change

Discovery Timeline

2026-07-21 - CVE-2026-61207 published to NVD
2026-07-22 - Last updated in NVD database
July 2026 - Included in Oracle Security Alert July 2026

Technical Details for CVE-2026-61207

Vulnerability Analysis

The vulnerability resides in the Manage Requisition Status component of PeopleSoft Enterprise SCM eProcurement 9.2. The component fails to enforce proper access control on HTTP-accessible endpoints. An attacker can reach the vulnerable functionality without credentials and without user interaction.

Oracle characterizes the flaw as easily exploitable. Successful exploitation yields high confidentiality impact and limited integrity impact. Attackers can read all data accessible to the eProcurement application and perform unauthorized inserts, updates, or deletes on a subset of that data.

The scope change indicator signals that exploitation impacts resources outside the vulnerable component's security authority. In PeopleSoft deployments, this typically means shared integration brokers, application server tiers, or federated data can be reached through the initial foothold.

Root Cause

The underlying weakness is classified under [CWE-284] Improper Access Control. The application does not adequately validate that the caller is authorized to access requisition status data or to perform state-changing actions. Missing authentication and authorization checks on network-reachable interfaces allow direct interaction with backend logic.

Attack Vector

Exploitation occurs over the network via HTTP against a PeopleSoft Enterprise SCM eProcurement 9.2 deployment. No credentials, tokens, or prior access are required. No user interaction is needed to trigger the vulnerability. Oracle has not published technical exploitation details. See the Oracle Security Alert July 2026 for vendor guidance.

Detection Methods for CVE-2026-61207

Indicators of Compromise

Unauthenticated HTTP requests to PeopleSoft eProcurement Manage Requisition Status URLs from external or unexpected internal sources
Unusual read or modification activity against requisition tables outside normal business hours
Session identifiers or user context anomalies in PeopleSoft application server logs correlated with requisition status transactions

Detection Strategies

Review PeopleSoft web server access logs for anonymous requests to eProcurement endpoints, especially those tied to requisition status handlers
Correlate database audit records with application session data to identify requisition changes lacking a valid authenticated user
Alert on HTTP responses returning requisition data to callers without corresponding authentication events

Monitoring Recommendations

Enable verbose logging on PeopleSoft Integration Broker and application servers for the SCM eProcurement module
Forward web tier, application tier, and database audit logs to a centralized analytics platform for correlation
Baseline normal requisition status traffic patterns and alert on statistical deviations in request volume or source diversity

How to Mitigate CVE-2026-61207

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for PeopleSoft Enterprise SCM eProcurement 9.2 without delay
Restrict network access to PeopleSoft eProcurement web endpoints so only trusted networks and VPN-authenticated users can reach them
Audit recent requisition data for unauthorized reads, inserts, updates, or deletes and review integration broker traffic for anomalies

Patch Information

Oracle addressed CVE-2026-61207 in the July 2026 Critical Patch Update. Administrators should follow the fix instructions in the Oracle Security Alert July 2026 and validate patch application against the affected PeopleSoft Enterprise SCM eProcurement 9.2 environment.

Workarounds

Place PeopleSoft eProcurement behind a web application firewall with rules restricting unauthenticated access to Manage Requisition Status URLs
Enforce network segmentation and require VPN or zero trust access for all PeopleSoft web tier interactions
Disable or restrict the Manage Requisition Status component if it is not required for business operations until the patch is applied

bash

# Example: restrict access to eProcurement paths at the reverse proxy
# (adapt path patterns to your PeopleSoft deployment)
location ~* /psc/.*/EPROCUREMENT/.* {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://peoplesoft_backend;
}