CVE-2026-60600 in PeopleSoft Enterprise FIN Project Costing
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise FIN Project Costing product of Oracle PeopleSoft (component: Projects). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Project Costing executes to compromise PeopleSoft Enterprise FIN Project Costing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Project Costing. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle PeopleSoft Enterprise FIN Project Costing version 9.2, specifically affecting the Projects component of the broader PeopleSoft suite. The flaw represents a critical security weakness that enables an attacker to gain full control over the targeted system with minimal prerequisites. The vulnerability's exploitability is classified as easily accessible, meaning that unauthorized individuals can leverage it without requiring specialized tools or extensive technical knowledge. The attack vector requires local network access to the infrastructure hosting the PeopleSoft application, which significantly broadens the potential threat surface since many organizations maintain their enterprise applications on internal networks where such access might be more readily obtained.
The technical nature of this vulnerability stems from insufficient authentication and authorization controls within the Projects component, allowing an attacker with basic system access to compromise the entire PeopleSoft Enterprise FIN Project Costing application. The CVSS 3.1 score of 7.8 indicates a high severity level that encompasses full impacts across confidentiality, integrity, and availability domains. This means successful exploitation could result in complete data breaches where sensitive financial information becomes accessible to unauthorized parties, system integrity could be compromised through potential code execution or data manipulation, and availability could be disrupted through denial-of-service conditions or complete system compromise. The vulnerability requires human interaction from users other than the attacker, suggesting that social engineering or user misconfiguration might be necessary components for initial access.
The operational impact of this vulnerability extends far beyond simple technical compromise, as PeopleSoft Enterprise FIN Project Costing typically handles critical financial data including project costing, budgeting, and resource allocation information. Organizations relying on this system could face severe financial consequences including unauthorized spending, fraudulent billing, or complete disruption of their financial planning processes. The compromise of such systems often leads to cascading effects throughout enterprise operations since project costing data frequently integrates with other financial modules, procurement systems, and reporting platforms. From a cybersecurity perspective, this vulnerability aligns with CWE-287 (Improper Authentication) and potentially CWE-310 (Cryptographic Issues), as it represents a failure in authentication mechanisms that allows unauthorized access to sensitive business-critical applications.
Mitigation strategies should focus on immediate patch management implementation through Oracle's security updates and advisories, while also implementing network segmentation to limit access to PeopleSoft infrastructure to authorized personnel only. Organizations should conduct comprehensive vulnerability assessments to identify all instances of the affected software and ensure proper access controls are implemented through role-based permissions and multi-factor authentication mechanisms. The ATT&CK framework would classify this vulnerability under T1078 (Valid Accounts) and T1566 (Phishing) as potential initial access vectors, with T1059 (Command and Scripting Interpreter) and T1482 (Domain Trust Discovery) representing possible post-exploitation activities. Regular security monitoring and log analysis should be implemented to detect any suspicious activities that might indicate exploitation attempts, while incident response procedures should include specific protocols for handling PeopleSoft application compromises to minimize business impact and ensure proper containment of affected systems.