CVE-2026-61207
A critical flaw in Oracle PeopleSoft’s eProcurement module lets anyone on the network read or change sensitive procurement data without authentication. The bug is in the Manage Requisition Status component of version 9.2. Attackers can steal or alter procurement records.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle PeopleSoft Enterprise SCM eProcurement, version 9.2, specifically the Manage Requisition Status component.
Real-world impact
An attacker could read confidential procurement information, or add, modify, or delete records, potentially leading to financial loss or fraud.
Why this severity
The CVSS score of 9.3 reflects that the flaw is easy to exploit over the network, requires no authentication, and can expose confidential data (high confidentiality impact). The integrity impact is lower because the attacker can change data but not all data, and availability is not affected.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources