What is the CVSS score of CVE-2026-60597?

CVE-2026-60597 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-60597?

An unfixed vulnerability in Oracle PeopleSoft Enterprise FIN Cash Management (version 9.2) exposes organizations to unauthorized disclosure and modification of all financial data through remote…

How to fix or mitigate CVE-2026-60597?

Within 24 hours, inventory all systems running Oracle PeopleSoft FIN Cash Management 9.2, isolate affected instances from untrusted networks, and review HTTP access logs for anomalous activity. Within 7 days, restrict Cash Management access to authenticated VPN or bastion host connections, deploy Web Application Firewall rules to block suspicious HTTP requests to the application, and establish continuous monitoring for unauthorized data access patterns; simultaneously escalate to Oracle Support for remediation options and timeline. Within 30 days, execute a planned upgrade to the latest available version of Oracle PeopleSoft Enterprise or implement a vendor-released patch when available; validate remediation through security testing before returning affected systems to production.

Oracle PeopleSoft CVE-2026-60597

EUVD-2026-46955 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-wm58-43v6-2q9x

Authentication Bypass Oracle Peoplesoft Enterprise Fin Cash Management

8.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.7 HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Remote HTTP reach and unauthenticated auth-bypass give AV:N/PR:N; Oracle's 'difficult to exploit' supports AC:H; shared PeopleTools runtime justifies S:C with high C/I and no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:28 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.7

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Management). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Cash Management. While the vulnerability is in PeopleSoft Enterprise FIN Cash Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Cash Management accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Cash Management accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Cash Management 9.2 allows a remote, unauthenticated attacker to read, create, delete, or modify all data accessible to the Cash Management component over HTTP. The flaw carries a scope change, meaning a successful attack can significantly impact products beyond Cash Management itself. No public exploit identified at time of analysis; the CVSS 3.1 base score is 8.7 driven by high confidentiality and integrity impact, though the vector rates exploitation as difficult (AC:H).

Technical ContextAI

PeopleSoft Enterprise is Oracle's suite of ERP applications, and the affected FIN Cash Management module manages corporate treasury, banking, and liquidity data within the Financials pillar. PeopleSoft applications run on the PeopleTools middleware stack (PIA web server, application server, and database), which explains why the CVSS scope is Changed - a compromise in one module can traverse the shared PeopleTools runtime to affect other integrated products. Oracle did not assign a CWE (listed N/A), but the intelligence tags flag 'Authentication Bypass', which is consistent with the PR:N (no privileges required) metric and points to a broken or missing access-control check reachable via HTTP.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); this CVE is addressed as part of that CPU cycle. No exact patched build number is provided in the input data, so treat the July 2026 CPU as the authoritative source and match the specific PeopleTools/Financials patch level to your deployment - do not rely on an invented version string. As a compensating control until patched, restrict network reachability of the PeopleSoft Internet Architecture (PIA) so Cash Management is not exposed to untrusted networks: place the web tier behind a VPN or reverse proxy with strict allow-listing, and consider WAF rules in front of the PIA endpoints; the trade-off is that overly broad blocking can disrupt legitimate treasury and bank-integration workflows. Monitor application and web-server logs for anomalous unauthenticated requests to Cash Management URLs. Because the vulnerability requires no authentication, network-level access restriction is the highest-value interim mitigation.