Peoplesoft Enterprise Fin Staffing Front Office CVE-2026-60593

Oracle PeopleSoft Enterprise FIN Staffing Front Office 9.2 contains a critical data integrity vulnerability (CVE-2026-60593) that allows unauthenticated remote attackers to create, delete, or modify staffing and financial records. This directly threatens the accuracy of financial reports, payroll records, and staffing decisions, exposing the organization to compliance violations, financial statement errors, and operational disruption.

Within 24 hours, immediately inventory all systems running Oracle PeopleSoft Enterprise FIN Staffing Front Office 9.2 and assess which are internet-exposed or accessible from untrusted networks; implement network-level access restrictions if available. Within 7 days, deploy compensating controls including strict input validation on data modification endpoints, request rate limiting, and enhanced audit logging to detect unauthorized changes; contact Oracle support to confirm the patch timeline and verify no internal hotfixes are available. Within 30 days, establish a concrete upgrade plan to transition to a patched version once Oracle releases it, and conduct a comprehensive forensic audit of all data modifications in Staffing Front Office since this disclosure to identify any unauthorized or suspicious changes.

No vendor-released patch identified at time of analysis. Implement network segmentation to restrict access to the Staffing Front Office component, enforce strict input validation on HTTP requests to prevent data modification attacks, enable and monitor detailed audit logging of create/update/delete operations, and require multi-factor authentication for administrative access to the affected system.