CVE-2026-60666
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via Oracle Net to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Human Resources accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Human Resources accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise HCM Human Resources version 9.2, specifically affecting the security component of the application. The flaw represents a significant security weakness that can be exploited by low-privileged attackers who gain network access through Oracle Net protocols. The vulnerability's difficulty level indicates it requires some technical expertise to exploit effectively, yet remains accessible to threat actors with basic privileges within the network environment.
The technical nature of this vulnerability stems from insufficient access controls and authentication mechanisms within the PeopleSoft security framework. Attackers can leverage their network connectivity to perform unauthorized operations that compromise the integrity and confidentiality of sensitive human resources data. The CVSS 3.1 score of 6.8 reflects the substantial impact potential, with high confidentiality and integrity impacts indicating that successful exploitation could allow attackers to create, delete, or modify critical personnel information and access all accessible data within the system.
The operational impact of this vulnerability extends beyond simple data theft, as it enables attackers to fundamentally alter the organization's human resources database. This includes the ability to manipulate employee records, compensation data, performance evaluations, and other sensitive personnel information that could be used for financial fraud, identity theft, or corporate espionage. The complete access potential means that attackers could potentially gain administrative control over critical HR systems, leading to widespread data compromise across the entire organization's human capital management infrastructure.
Organizations should implement immediate mitigations including network segmentation to limit Oracle Net access to authorized systems only, implementing robust firewall rules to restrict access based on IP addresses and trusted networks, and ensuring proper patch management protocols are in place. The vulnerability aligns with CWE-284 (Improper Access Control) and may map to ATT&CK techniques involving privilege escalation and credential access. Additional protective measures include enabling multi-factor authentication for administrative access, implementing network monitoring to detect unusual Oracle Net traffic patterns, and conducting regular security assessments of PeopleSoft environments. Organizations should also consider implementing data loss prevention solutions to monitor for unauthorized data access or exfiltration attempts that could indicate exploitation of this vulnerability.