What is the CVSS score of CVE-2026-60593?

CVE-2026-60593 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Peoplesoft Enterprise Fin Staffing Front Office are affected by CVE-2026-60593?

Oracle PeopleSoft Enterprise FIN Staffing Front Office 9.2 contains a critical data integrity vulnerability (CVE-2026-60593) that allows unauthenticated remote attackers to create, delete, or modify…

How to fix or mitigate CVE-2026-60593?

Within 24 hours, immediately inventory all systems running Oracle PeopleSoft Enterprise FIN Staffing Front Office 9.2 and assess which are internet-exposed or accessible from untrusted networks; implement network-level access restrictions if available. Within 7 days, deploy compensating controls including strict input validation on data modification endpoints, request rate limiting, and enhanced audit logging to detect unauthorized changes; contact Oracle support to confirm the patch timeline and verify no internal hotfixes are available. Within 30 days, establish a concrete upgrade plan to transition to a patched version once Oracle releases it, and conduct a comprehensive forensic audit of all data modifications in Staffing Front Office since this disclosure to identify any unauthorized or suspicious changes.

Peoplesoft Enterprise Fin Staffing Front Office CVE-2026-60593

EUVD-2026-46951 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-7h7h-6p73-23mw

Authentication Bypass Microsoft Oracle Peoplesoft Enterprise Fin Staffing Front Office

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:29 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Staffing Front Office product of Oracle PeopleSoft (component: Staffing Front Office). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Staffing Front Office. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Staffing Front Office accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

AnalysisAI

Unauthorized data modification in Oracle PeopleSoft Enterprise FIN Staffing Front Office 9.2 allows a remote, unauthenticated attacker to create, delete, or modify critical data via crafted HTTP requests. The flaw is confined to the Staffing Front Office component and carries an integrity-only impact (CVSS 3.1 7.5, C:N/I:H/A:N). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.