PeopleSoft In-Memory Project Discovery Remote Code Execution

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Oracle

Description

Vulnerability in the PeopleSoft In-Memory Project Discovery product of Oracle PeopleSoft (component: Project Discovery). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft In-Memory Project Discovery. While the vulnerability is in PeopleSoft In-Memory Project Discovery, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of PeopleSoft In-Memory Project Discovery. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-61209

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	peoplesoft_in_memory_project_discovery	9.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle PeopleSoft In-Memory Project Discovery version 9.2. It allows a low-privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a full takeover of the PeopleSoft In-Memory Project Discovery product. The vulnerability has a CVSS base score of 9.9, indicating severe impacts on confidentiality, integrity, and availability.

Impact Analysis

An attacker could gain control of the PeopleSoft In-Memory Project Discovery system, potentially leading to unauthorized access, data theft, or disruption of services. Since attacks may impact additional products, the impact could extend beyond the immediate system.

Mitigation Strategies

Apply the latest security patches from Oracle for PeopleSoft In-Memory Project Discovery version 9.2. Restrict network access to the HTTP interface to trusted sources only. Monitor for unusual activity in the PeopleSoft In-Memory Project Discovery component.

Hi! I’m here to help you understand CVE-2026-61209. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70