CVE-2026-61203

Oracle has fixed 84 vulnerabilities in various modules of Oracle PeopleSoft Enterprise, including HCM Talent Acquisition Manager, In-Memory Project Discovery, FIN Expenses, SCM eProcurement, CC Common Application Objects, SCM Order Management, CRM Common Objects, and FIN Program Management, all version 9.2. Some of these 84 vulnerabilities concern objects that are important for other countries and are therefore not relevant for systems in the Netherlands. The most severe vulnerabilities, 8 in total, have received a high score ranging from 9.1 to 9.9 and are located in various Oracle PeopleSoft Enterprise components. The two most severe vulnerabilities in HCM Talent Acquisition Manager and Project Discovery, with a score of 9.9, allow an attacker with low privileges and network access via HTTP to fully compromise the system. This allows the attacker to affect the confidentiality, integrity, and availability of the environment. The vulnerability may also impact other Oracle products outside the Talent Acquisition Manager module. The vulnerability in Enterprise FIN Expenses, with a score of 9.4, allows unauthenticated external attackers to gain unauthorized access to the system. By exploiting this vulnerability, attackers can modify or delete data within the application. Additionally, the vulnerability can be used to cause a partial denial-of-service (DoS). The vulnerability in SCM eProcurement, with a score of 9.3, allows unauthenticated attackers with network access via HTTP to gain unauthorized access to the system. By exploiting this vulnerability, an attacker can modify critical data within the affected application. The vulnerability may also affect other related Oracle PeopleSoft products.

[![CVE-2026-61203 status](https://www.csirts.com/badge/CVE-2026-61203)](https://www.csirts.com/cve/CVE-2026-61203)