NCSC-2026-0260

Vulnerability from csaf_ncscnl - Published: 2026-07-22 15:23 - Updated: 2026-07-22 15:23
Summary
Kwetsbaarheden verholpen in Oracle PeopleSoft Enterprise
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Oracle heeft 84 kwetsbaarheden verholpen in verschillende modules van Oracle PeopleSoft Enterprise, waaronder HCM Talent Acquisition Manager, In-Memory Project Discovery, FIN Expenses, SCM eProcurement, CC Common Application Objects, SCM Order Management, CRM Common Objects en FIN Program Management, allen versie 9.2. Een deel van deze 84 kwetsbaarheden betreft objecten die belangrijk zijn voor andere landen en zijn dus niet relevant voor sytemen in Nederland.
Interpretaties: De ernstigste kwetsbaarheden, 8 stuks, hebben een hoge score variërend van 9.1 tot 9.9 gekregen en bevinden zich in diverse Oracle PeopleSoft Enterprise componenten. De twee meest ernstige kwetsbaarheden in HCM Talent Acquisition Manager en Project Discovery, met de score van 9.9 maken het mogelijk voor een aanvaller met lage privileges en netwerktoegang via HTTP om het systeem volledig te compromitteren. Hierdoor kan de aanvaller de vertrouwelijkheid, integriteit en beschikbaarheid van de omgeving beïnvloeden. De kwetsbaarheid kan ook impact hebben op andere Oracle-producten buiten de Talent Acquisition Manager module. De kwetsbaarheid in Enterprise FIN Expenses, met de score van 9.4 maakt het mogelijk voor niet-geauthenticeerde externe aanvallers om ongeautoriseerde toegang te verkrijgen tot het systeem. Door misbruik van deze kwetsbaarheid kunnen aanvallers data binnen de applicatie wijzigen of verwijderen. Daarnaast kan de kwetsbaarheid worden gebruikt om een gedeeltelijke denial-of-service (DoS) te veroorzaken. De kwetsbaarheid in SCM eProcurement, met de score 9.3 maakt het mogelijk voor ongeauthenticeerde aanvallers met netwerktoegang via HTTP om ongeautoriseerde toegang tot het systeem te verkrijgen. Door misbruik van deze kwetsbaarheid kan een aanvaller kritieke gegevens binnen de getroffen applicatie wijzigen. De kwetsbaarheid kan ook invloed hebben op andere gerelateerde Oracle PeopleSoft producten. De kwetsbaarheid in Common Application Objects, met de score 9.1 maakt het mogelijk voor ongeauthenticeerde aanvallers met netwerktoegang via HTTP om onbevoegd kritieke data te creëren, verwijderen of wijzigen. Dit betreft de Common Application Objects component binnen de PeopleSoft Enterprise suite. Aanvallers kunnen hierdoor gevoelige data manipuleren zonder authenticatie. De kwetsbaarheid in SCM Order Management, met de score 9.1 maakt het mogelijk voor ongeauthenticeerde aanvallers met netwerktoegang via HTTP om onbevoegd kritieke data te creëren, verwijderen of wijzigen. Dit betreft de Common Application Objects component binnen de PeopleSoft Enterprise suite. Aanvallers kunnen hierdoor gevoelige data manipuleren zonder authenticatie. De kwetsbaarheid in Enterprise CRM Common Objects, met score 9.0 maakt het mogelijk voor ongeauthenticeerde aanvallers met netwerktoegang via HTTP om onbevoegd kritieke data te creëren, verwijderen of wijzigen. Dit betreft de Common Application Objects component binnen de PeopleSoft Enterprise suite. Aanvallers kunnen hierdoor gevoelige data manipuleren zonder authenticatie. De kwetsbaarheid in Program Management, met score 9.0 maakt het mogelijk voor een aanvaller met beperkte rechten en netwerktoegang, en die gebruikersinteractie vereist, om mogelijk volledige controle over het getroffen systeem te verkrijgen. De kwetsbaarheid beïnvloedt de vertrouwelijkheid, integriteit en beschikbaarheid van het systeem. De overige kwetsbaarheden hebben lagere scores gekregen dan 9. Deze kunnen leiden tot compromittering van vertrouwelijkheid, integriteit en beschikbaarheid van de systemen. Sommige kwetsbaarheden vereisen gebruikersinteractie, terwijl andere dat niet doen. De impact strekt zich uit over meerdere modules binnen de PeopleSoft Enterprise suite en kan ook andere gerelateerde Oracle producten beïnvloeden. De detailinformatie voor deze kwetsbaarheden is niet opgenomen in deze advisory en het NCSC verwijst daarom naar de bijgevoegde referentie.
Oplossingen: Oracle heeft updates uitgebracht om de kwetsbaarheden in Oracle PeopleSoft Enterprise te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2026-61076

A critical vulnerability (CVSS 9.9) in Oracle PeopleSoft Enterprise HCM Talent Acquisition Manager 9.2 enables a low-privileged attacker with HTTP network access to fully compromise the system and potentially affect additional products.

9.9 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / PeopleSoft
 vers:unknown/*
vers:unknown/*
Oracle / PeopleSoft Enterprise CC Common Application Objects
 vers:unknown/*
vers:unknown/*
Oracle / PeopleSoft Enterprise HCM Talent Acquisition Manager
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise CRM Common Objects
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise FIN Expenses
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise FIN Program Management
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise SCM Order Management
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise SCM eProcurement
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft In-Memory Project Discovery
 vers:unknown/*
CVE-2026-61209

A critical CVSS 9.9 vulnerability in Oracle PeopleSoft In-Memory Project Discovery 9.2 enables a low-privileged attacker with HTTP network access to fully compromise the system, risking confidentiality, integrity, and availability.

9.9 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / PeopleSoft
 vers:unknown/*
vers:unknown/*
Oracle / PeopleSoft Enterprise CC Common Application Objects
 vers:unknown/*
vers:unknown/*
Oracle / PeopleSoft Enterprise HCM Talent Acquisition Manager
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise CRM Common Objects
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise FIN Expenses
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise FIN Program Management
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise SCM Order Management
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise SCM eProcurement
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft In-Memory Project Discovery
 vers:unknown/*
CVE-2026-61203

A critical vulnerability in Oracle PeopleSoft Enterprise FIN Expenses 9.2 enables unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 base score of 9.4.

9.4 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / PeopleSoft
 vers:unknown/*
vers:unknown/*
Oracle / PeopleSoft Enterprise CC Common Application Objects
 vers:unknown/*
vers:unknown/*
Oracle / PeopleSoft Enterprise HCM Talent Acquisition Manager
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise CRM Common Objects
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise FIN Expenses
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise FIN Program Management
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise SCM Order Management
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise SCM eProcurement
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft In-Memory Project Discovery
 vers:unknown/*
CVE-2026-61207

A critical vulnerability (CVSS 9.3) in Oracle PeopleSoft Enterprise SCM eProcurement 9.2 enables unauthenticated attackers with HTTP network access to gain unauthorized access and modify critical data, affecting related products.

9.3 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / PeopleSoft
 vers:unknown/*
vers:unknown/*
Oracle / PeopleSoft Enterprise CC Common Application Objects
 vers:unknown/*
vers:unknown/*
Oracle / PeopleSoft Enterprise HCM Talent Acquisition Manager
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise CRM Common Objects
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise FIN Expenses
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise FIN Program Management
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise SCM Order Management
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise SCM eProcurement
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft In-Memory Project Discovery
 vers:unknown/*
CVE-2026-60606

A critical vulnerability in Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 score of 9.1 indicating high confidentiality and integrity impact.

9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / PeopleSoft
 vers:unknown/*
vers:unknown/*
Oracle / PeopleSoft Enterprise CC Common Application Objects
 vers:unknown/*
vers:unknown/*
Oracle / PeopleSoft Enterprise HCM Talent Acquisition Manager
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise CRM Common Objects
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise FIN Expenses
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise FIN Program Management
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise SCM Order Management
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise SCM eProcurement
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft In-Memory Project Discovery
 vers:unknown/*
CVE-2026-61059

A critical vulnerability in Oracle PeopleSoft Enterprise SCM Order Management 9.2 allows unauthenticated remote attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 9.1 indicating high confidentiality and integrity impact.

9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / PeopleSoft
 vers:unknown/*
vers:unknown/*
Oracle / PeopleSoft Enterprise CC Common Application Objects
 vers:unknown/*
vers:unknown/*
Oracle / PeopleSoft Enterprise HCM Talent Acquisition Manager
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise CRM Common Objects
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise FIN Expenses
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise FIN Program Management
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise SCM Order Management
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise SCM eProcurement
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft In-Memory Project Discovery
 vers:unknown/*
CVE-2026-61201

A critical vulnerability in Oracle PeopleSoft Enterprise CRM Common Objects 9.2.23 allows unauthenticated remote attackers to compromise system confidentiality, integrity, and availability, with a CVSS score of 9.0.

9.0 (Critical)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / PeopleSoft
 vers:unknown/*
vers:unknown/*
Oracle / PeopleSoft Enterprise CC Common Application Objects
 vers:unknown/*
vers:unknown/*
Oracle / PeopleSoft Enterprise HCM Talent Acquisition Manager
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise CRM Common Objects
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise FIN Expenses
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise FIN Program Management
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise SCM Order Management
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise SCM eProcurement
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft In-Memory Project Discovery
 vers:unknown/*
CVE-2026-61204

A critical vulnerability in Oracle PeopleSoft Enterprise FIN Program Management 9.2 allows a low-privileged attacker with network access and user interaction to potentially compromise system confidentiality, integrity, and availability, rated CVSS 9.0.

9.0 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / PeopleSoft
 vers:unknown/*
vers:unknown/*
Oracle / PeopleSoft Enterprise CC Common Application Objects
 vers:unknown/*
vers:unknown/*
Oracle / PeopleSoft Enterprise HCM Talent Acquisition Manager
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise CRM Common Objects
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise FIN Expenses
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise FIN Program Management
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise SCM Order Management
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft Enterprise SCM eProcurement
 vers:unknown/*
vers:unknown/*
Oracle Corporation / PeopleSoft In-Memory Project Discovery
 vers:unknown/*
References
To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Oracle heeft 84 kwetsbaarheden verholpen in verschillende modules van Oracle PeopleSoft Enterprise, waaronder HCM Talent Acquisition Manager, In-Memory Project Discovery, FIN Expenses, SCM eProcurement, CC Common Application Objects, SCM Order Management, CRM Common Objects en FIN Program Management, allen versie 9.2.\n\nEen deel van deze 84 kwetsbaarheden betreft objecten die belangrijk zijn voor andere landen en zijn dus niet relevant voor sytemen in Nederland. ",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De ernstigste kwetsbaarheden, 8 stuks, hebben een hoge score vari\u00ebrend van 9.1 tot 9.9 gekregen en bevinden zich in diverse Oracle PeopleSoft Enterprise componenten.\n\nDe twee meest ernstige kwetsbaarheden in HCM Talent Acquisition Manager en Project Discovery, met de score van 9.9 maken het mogelijk voor een aanvaller met lage privileges en netwerktoegang via HTTP om het systeem volledig te compromitteren. Hierdoor kan de aanvaller de vertrouwelijkheid, integriteit en beschikbaarheid van de omgeving be\u00efnvloeden. De kwetsbaarheid kan ook impact hebben op andere Oracle-producten buiten de Talent Acquisition Manager module.\n\nDe kwetsbaarheid in Enterprise FIN Expenses, met de score van 9.4 maakt het mogelijk voor niet-geauthenticeerde externe aanvallers om ongeautoriseerde toegang te verkrijgen tot het systeem. Door misbruik van deze kwetsbaarheid kunnen aanvallers data binnen de applicatie wijzigen of verwijderen. Daarnaast kan de kwetsbaarheid worden gebruikt om een gedeeltelijke denial-of-service (DoS) te veroorzaken.\n\nDe kwetsbaarheid in SCM eProcurement, met de score 9.3 maakt het mogelijk voor ongeauthenticeerde aanvallers met netwerktoegang via HTTP om ongeautoriseerde toegang tot het systeem te verkrijgen. Door misbruik van deze kwetsbaarheid kan een aanvaller kritieke gegevens binnen de getroffen applicatie wijzigen. De kwetsbaarheid kan ook invloed hebben op andere gerelateerde Oracle PeopleSoft producten.\n\nDe kwetsbaarheid in Common Application Objects, met de score 9.1 maakt het mogelijk voor ongeauthenticeerde aanvallers met netwerktoegang via HTTP om onbevoegd kritieke data te cre\u00ebren, verwijderen of wijzigen. Dit betreft de Common Application Objects component binnen de PeopleSoft Enterprise suite. Aanvallers kunnen hierdoor gevoelige data manipuleren zonder authenticatie.\n\nDe kwetsbaarheid in SCM Order Management, met de score 9.1 maakt het mogelijk voor ongeauthenticeerde aanvallers met netwerktoegang via HTTP om onbevoegd kritieke data te cre\u00ebren, verwijderen of wijzigen. Dit betreft de Common Application Objects component binnen de PeopleSoft Enterprise suite. Aanvallers kunnen hierdoor gevoelige data manipuleren zonder authenticatie.\n\nDe kwetsbaarheid in Enterprise CRM Common Objects, met score 9.0 maakt het mogelijk voor ongeauthenticeerde aanvallers met netwerktoegang via HTTP om onbevoegd kritieke data te cre\u00ebren, verwijderen of wijzigen. Dit betreft de Common Application Objects component binnen de PeopleSoft Enterprise suite. Aanvallers kunnen hierdoor gevoelige data manipuleren zonder authenticatie.\n\nDe kwetsbaarheid in Program Management, met score 9.0 maakt het mogelijk voor een aanvaller met beperkte rechten en netwerktoegang, en die gebruikersinteractie vereist, om mogelijk volledige controle over het getroffen systeem te verkrijgen. De kwetsbaarheid be\u00efnvloedt de vertrouwelijkheid, integriteit en beschikbaarheid van het systeem.\n\nDe overige kwetsbaarheden hebben lagere scores gekregen dan 9. Deze kunnen leiden tot compromittering van vertrouwelijkheid, integriteit en beschikbaarheid van de systemen. Sommige kwetsbaarheden vereisen gebruikersinteractie, terwijl andere dat niet doen. De impact strekt zich uit over meerdere modules binnen de PeopleSoft Enterprise suite en kan ook andere gerelateerde Oracle producten be\u00efnvloeden.\n\nDe detailinformatie voor deze kwetsbaarheden is niet opgenomen in deze advisory en het NCSC verwijst daarom naar de bijgevoegde referentie.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Oracle heeft updates uitgebracht om de kwetsbaarheden in Oracle PeopleSoft Enterprise te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Exposure of Sensitive Information to an Unauthorized Actor",
        "title": "CWE-200"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.oracle.com/security-alerts/cpujul2026verbose.html"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Oracle PeopleSoft Enterprise",
    "tracking": {
      "current_release_date": "2026-07-22T15:23:26.742169Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0260",
      "initial_release_date": "2026-07-22T15:23:26.742169Z",
      "revision_history": [
        {
          "date": "2026-07-22T15:23:26.742169Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft Enterprise CC Common Application Objects"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-3"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft Enterprise HCM Talent Acquisition Manager"
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-4"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft Enterprise CRM Common Objects"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-5"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft Enterprise FIN Expenses"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-6"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft Enterprise FIN Program Management"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-7"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft Enterprise SCM Order Management"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-8"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft Enterprise SCM eProcurement"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-9"
                }
              }
            ],
            "category": "product_name",
            "name": "PeopleSoft In-Memory Project Discovery"
          }
        ],
        "category": "vendor",
        "name": "Oracle Corporation"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-61076",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability (CVSS 9.9) in Oracle PeopleSoft Enterprise HCM Talent Acquisition Manager 9.2 enables a low-privileged attacker with HTTP network access to fully compromise the system and potentially affect additional products.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-61076 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61076.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9"
          ]
        }
      ],
      "title": "CVE-2026-61076"
    },
    {
      "cve": "CVE-2026-61209",
      "notes": [
        {
          "category": "description",
          "text": "A critical CVSS 9.9 vulnerability in Oracle PeopleSoft In-Memory Project Discovery 9.2 enables a low-privileged attacker with HTTP network access to fully compromise the system, risking confidentiality, integrity, and availability.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-61209 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61209.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9"
          ]
        }
      ],
      "title": "CVE-2026-61209"
    },
    {
      "cve": "CVE-2026-61203",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability in Oracle PeopleSoft Enterprise FIN Expenses 9.2 enables unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 base score of 9.4.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-61203 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61203.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9"
          ]
        }
      ],
      "title": "CVE-2026-61203"
    },
    {
      "cve": "CVE-2026-61207",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability (CVSS 9.3) in Oracle PeopleSoft Enterprise SCM eProcurement 9.2 enables unauthenticated attackers with HTTP network access to gain unauthorized access and modify critical data, affecting related products.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-61207 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61207.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9"
          ]
        }
      ],
      "title": "CVE-2026-61207"
    },
    {
      "cve": "CVE-2026-60606",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability in Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 score of 9.1 indicating high confidentiality and integrity impact.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-60606 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60606.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9"
          ]
        }
      ],
      "title": "CVE-2026-60606"
    },
    {
      "cve": "CVE-2026-61059",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability in Oracle PeopleSoft Enterprise SCM Order Management 9.2 allows unauthenticated remote attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 9.1 indicating high confidentiality and integrity impact.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-61059 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61059.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9"
          ]
        }
      ],
      "title": "CVE-2026-61059"
    },
    {
      "cve": "CVE-2026-61201",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability in Oracle PeopleSoft Enterprise CRM Common Objects 9.2.23 allows unauthenticated remote attackers to compromise system confidentiality, integrity, and availability, with a CVSS score of 9.0.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-61201 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61201.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9"
          ]
        }
      ],
      "title": "CVE-2026-61201"
    },
    {
      "cve": "CVE-2026-61204",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability in Oracle PeopleSoft Enterprise FIN Program Management 9.2 allows a low-privileged attacker with network access and user interaction to potentially compromise system confidentiality, integrity, and availability, rated CVSS 9.0.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-61204 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61204.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9"
          ]
        }
      ],
      "title": "CVE-2026-61204"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.