CVE-2026-60595
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise FIN Pay/Bill Management product of Oracle PeopleSoft (component: Paybill Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Pay/Bill Management executes to compromise PeopleSoft Enterprise FIN Pay/Bill Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Pay/Bill Management accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise FIN Pay/Bill Management version 9.2, specifically in the Paybill Management component, representing a significant security weakness that can be exploited by attackers with minimal privileges. The vulnerability's classification as easily exploitable indicates that the attack vector requires low complexity and that an attacker with valid login credentials to the target infrastructure can successfully compromise the system. This presents a critical risk because it allows lateral movement and privilege escalation within the PeopleSoft environment, potentially enabling unauthorized access to sensitive financial data.
The technical flaw stems from inadequate access controls or authentication mechanisms within the Paybill Management component, which permits low-privileged users with legitimate system access to escalate their privileges and gain unauthorized access to critical data. The CVSS 3.1 base score of 5.5 with a confidentiality impact rating of high (C:H) demonstrates that successful exploitation could lead to complete disclosure of all accessible data within the PeopleSoft environment. This vulnerability operates under the attack vector AV:L which indicates local system access is required, AC:L meaning low attack complexity, and PR:L showing that only low privileges are needed for exploitation.
The operational impact of this vulnerability extends beyond simple data theft, as it can result in complete compromise of the financial management systems that handle sensitive payroll and billing information. Organizations utilizing PeopleSoft Enterprise FIN Pay/Bill Management may face severe consequences including regulatory violations, financial loss, and reputational damage if attackers exploit this weakness to access confidential employee payroll records, vendor payment information, or other critical business data. The vulnerability's potential for unauthorized data access aligns with CWE-284 (Improper Access Control) and represents a significant risk within the ATT&CK framework under Privilege Escalation techniques.
Mitigation strategies should include immediate implementation of the latest Oracle security patches and updates specifically addressing this vulnerability, along with enhanced monitoring of system access logs for suspicious activities. Organizations must conduct thorough security assessments to identify all instances of the affected PeopleSoft version and implement network segmentation to limit lateral movement capabilities. Additional controls should focus on principle of least privilege enforcement, regular access reviews, and implementation of privileged access management solutions. The vulnerability's characteristics suggest that layered defense mechanisms are essential since a single point of compromise could lead to complete system takeover, making comprehensive security posture improvements critical for protecting sensitive financial information.