Oracle PeopleSoft CVE-2026-60597

Exploitation requires network access to the PeopleSoft Internet Architecture web tier over HTTP against PeopleSoft Enterprise FIN Cash Management 9.2, with no authentication needed (PR:N) and no user interaction (UI:N). What limits exploitation is the high attack complexity (AC:H): the CVSS vector indicates the attacker must satisfy conditions outside their direct control - such as a specific configuration state, timing/race window, or knowledge of environment-specific details - which is why Oracle labels it 'difficult to exploit.' Realistic risk is therefore concentrated on PeopleSoft deployments whose Cash Management web endpoints are reachable from untrusted or internet-facing networks; systems isolated behind VPN or strict network controls face substantially lower exposure. The precise technical trigger is not detailed in the available data beyond the 'Authentication Bypass' tag.

The signals are mixed and warrant nuance. The CVSS 3.1 score of 8.7 (High) is elevated primarily by the Changed scope plus dual High confidentiality and integrity impact, but AC:H explicitly marks the attack as difficult to exploit, which materially lowers real-world likelihood versus a typical PR:N/AC:L network bug. No CWE was provided, no EPSS score is available in the input, the CVE is not listed in CISA KEV, and no proof-of-concept is referenced - so there is no evidence of active or imminent exploitation. The 'Authentication Bypass' tag aligns with PR:N and raises concern, but the AC:H requirement (attacker must win a race, satisfy a specific precondition, or hold non-obvious knowledge of the environment) suggests this is a genuine priority for internet-exposed PeopleSoft treasury systems rather than a mass-exploitation candidate. EPSS is missing and should be checked before final prioritization; absence of KEV/POC data is not proof of safety.

An attacker who can reach the PeopleSoft PIA web tier over HTTP sends specially crafted requests that bypass authentication to reach Cash Management functionality without valid credentials, then reads or tampers with sensitive treasury and banking data. Given the Changed scope, the attacker may pivot the impact into other integrated PeopleSoft modules. The AC:H rating means exploitation is not trivial and likely depends on specific environmental conditions or timing; no public exploit code is currently identified.