CVE-2017-3525: Vulnerability in the PeopleSoft Enterprise SCM Service Procurement component of Oracle PeopleSoft Products...

Security readout for executives and security teams

This affects Oracle PeopleSoft Enterprise SCM Service Procurement 9.2. A highly privileged user who can reach the application over HTTP could read, create, modify, or delete critical Service Procurement data. Business urgency depends on whether this module is deployed and reachable, because the issue targets sensitive procurement records. Exposure is most likely in organizations running PeopleSoft Enterprise SCM Service Procurement 9.2, especially where HTTP access is available to privileged users. The source bundle does not identify other versions, products, or deployment modes as affected. Treat this as a targeted data-risk issue, not a broad unauthenticated internet worm risk. Prioritize if PeopleSoft SCM Service Procurement 9.2 remains in use, stores material procurement data, or is reachable by many privileged users. Mitigation focus: Check Oracle Critical Patch Update guidance for April 2017 and later supported fixes.; Confirm whether PeopleSoft Enterprise SCM Service Procurement 9.2 is deployed.; Limit HTTP access to PeopleSoft administrative and privileged user paths..

Prepared

Jun 13, 2026, 05:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.