CVE-2025-61761
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Maintenance Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Maintenance Management accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Maintenance Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).
Risk Assessment
Breach of confidentiality and integrity through unauthorized modifications and data access. May lead to information leakage and incorrect changes in the system.
Recommendation
Apply available Oracle patches for version 9.2. Restrict network access to the Work Order Management component.
Other vulnerabilities in Oracle PeopleSoft
See all- CVE-2026-83420High
Vulnerability in PeopleSoft Enterprise FIN Engineering Brazil (Oracle PeopleSoft), component Engineering, affecting version 9.1. A low-privileged authenticated attacker with local access can take over the system. CVSS 3.1 Base Score 7.8.
- CVE-2026-83147High
Vulnerability in the PeopleSoft Enterprise FIN Inventory Brazil product of Oracle PeopleSoft (component: Inventory) affecting version 9.1. A low-privileged attacker with local logon can take over PeopleSoft Enterprise FIN Inventory Brazil.
- CVE-2026-61240High
In PeopleSoft Enterprise FIN Common Objects Argentina (part of Oracle PeopleSoft) version 9.1, an easily exploitable vulnerability allows an unauthenticated attacker with access to the physical communication segment. Attacks may significantly impact additional products (scope change) and result in unauthorized access to critical data and modification capabilities.
- CVE-2026-61234High
Vulnerability in PeopleSoft Enterprise FIN Common Objects Brazil (part of Oracle PeopleSoft) version 9.1. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTP to unauthorizedly read and modify critical data. CVSS 7.4.
- CVE-2026-61210High
Vulnerability in PeopleSoft Enterprise SCM Manufacturing (part of Oracle PeopleSoft) version 9.2. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTPS to unauthorizedly read and modify critical data. CVSS 7.4.
- CVE-2026-61205High
Vulnerability in PeopleSoft Enterprise SCM Purchasing (part of Oracle PeopleSoft) version 9.2. An easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to unauthorizedly modify critical data and read a subset of data. CVSS 8.2.
- CVE-2026-61104Low
Vulnerability in Oracle PeopleSoft Enterprise CS Student Records (Research Tracking component) version 9.2.38. Difficult to exploit, allows unauthenticated attacker to gain unauthorized read access to a subset of data.
- CVE-2026-61088High
Vulnerability in PeopleSoft Enterprise SCM Manufacturing product of Oracle PeopleSoft, component Security. Affects version 9.2. An unauthenticated attacker can remotely access critical data or all data in the system via HTTP.
- CVE-2026-61087High
Vulnerability in PeopleSoft Enterprise FIN Payables product of Oracle PeopleSoft, component Security. Affects version 9.2. An unauthenticated attacker can remotely access critical data or all data in the system via HTTP.
- CVE-2026-61086High
Vulnerability in PeopleSoft Enterprise SCM Order Management product of Oracle PeopleSoft, component Security. Affects version 9.2. An unauthenticated attacker can remotely access critical data or all data in the system via HTTPS.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Maintenance Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Maintenance Management accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Maintenance Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS