NCSC-2026-0260 [1.00] [M/H] Vulnerabilities fixed in Oracle PeopleSoft Enterprise

unknownCVE-2026-61076 CVE-2026-61209 CVE-2026-61203 CVE-2026-61207 CVE-2026-60606 CVE-2026-61059

Oracle has fixed 84 vulnerabilities in various modules of Oracle PeopleSoft Enterprise, including HCM Talent Acquisition Manager, In-Memory Project Discovery, FIN Expenses, SCM eProcurement, CC Common Application Objects, SCM Order Management, CRM Common Objects, and FIN Program Management, all version 9.2. Some of these 84 vulnerabilities concern objects that are important for other countries and are therefore not relevant for systems in the Netherlands. The most severe vulnerabilities, 8 in total, have received a high score ranging from 9.1 to 9.9 and are located in various Oracle PeopleSoft Enterprise components. The two most severe vulnerabilities in HCM Talent Acquisition Manager and Project Discovery, with a score of 9.9, allow an attacker with low privileges and network access via HTTP to fully compromise the system. This allows the attacker to affect the confidentiality, integrity, and availability of the environment. The vulnerability may also impact other Oracle products outside the Talent Acquisition Manager module. The vulnerability in Enterprise FIN Expenses, with a score of 9.4, allows unauthenticated external attackers to gain unauthorized access to the system. By exploiting this vulnerability, attackers can modify or delete data within the application. Additionally, the vulnerability can be used to cause a partial denial-of-service (DoS). The vulnerability in SCM eProcurement, with a score of 9.3, allows unauthenticated attackers with network access via HTTP to gain unauthorized access to the system. By exploiting this vulnerability, an attacker can modify critical data within the affected application. The vulnerability may also affect other related Oracle PeopleSoft products.

CSIRTS triage

vendor: Oracle product: PeopleSoft Enterprise Remote code executionOtheraffected: 9.2

What: The vulnerabilities can lead to full system compromise via HTTP.
Who is affected: Deployments of Oracle PeopleSoft Enterprise version 9.2.
Urgency: Remediation is critical due to the high severity of some vulnerabilities.
Action: Apply the latest patches for Oracle PeopleSoft Enterprise.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch PeopleSoft Enterprise

Get an email when a new PeopleSoft Enterprise advisory drops — max one per day, one-click unsubscribe.

Details

Source: NCSC-NL Advisories (NL · national-cert · site)
Severity: unknown
Published: 2026-07-22
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0260

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-610760.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all scored CVEs.
Low exploitation riskCVE-2026-612090.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all scored CVEs.
Low exploitation riskCVE-2026-612030.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all scored CVEs.
Low exploitation riskCVE-2026-612070.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all scored CVEs.
Low exploitation riskCVE-2026-606060.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all scored CVEs.
Low exploitation riskCVE-2026-610590.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all scored CVEs.
Low exploitation riskCVE-2026-612010.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all scored CVEs.
Low exploitation riskCVE-2026-612040.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-61076	coverage & exploitation status	NVD · CVE.org
CVE-2026-61209	coverage & exploitation status	NVD · CVE.org
CVE-2026-61203	coverage & exploitation status	NVD · CVE.org
CVE-2026-61207	coverage & exploitation status	NVD · CVE.org
CVE-2026-60606	coverage & exploitation status	NVD · CVE.org
CVE-2026-61059	coverage & exploitation status	NVD · CVE.org
CVE-2026-61201	coverage & exploitation status	NVD · CVE.org
CVE-2026-61204	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.