Oracle PeopleSoft CVE-2026-60600

Exploitation requires two concrete prerequisites drawn from the CVE description: (1) the attacker must have a logon to the infrastructure where PeopleSoft Enterprise FIN Project Costing 9.2 executes - i.e., local access to the application host, consistent with CVSS AV:L; and (2) successful human interaction from a person other than the attacker (UI:R), meaning a separate legitimate PeopleSoft user must perform an action that triggers the flaw. Only version 9.2 of the FIN Project Costing (Projects component) is affected. These factors - the need for an existing infrastructure foothold and reliance on a third party's action - significantly limit exploitation and rule out remote unauthenticated attacks against a default internet-facing deployment.

Signals are moderately consistent and point to a real but access-constrained risk. The CVSS 3.1 base score is 7.8 (High), driven by full C/I/A impact and low attack complexity, but the local attack vector (AV:L) and required user interaction (UI:R) substantially raise the practical bar: an attacker must already have logon access to the PeopleSoft host infrastructure AND induce a separate legitimate user to act. Note a tension worth verifying with the vendor - the vector states PR:N (no privileges) yet the description requires the attacker to 'logon to the infrastructure,' which is itself a form of access; treat 'unauthenticated' with caution as this reflects Oracle's CPU scoring convention rather than open network exposure. No EPSS score, KEV listing, or POC was provided, so exploitation probability cannot be quantified; absence of these signals suggests this is not currently a mass-exploitation priority but should be patched on Oracle's normal CPU cadence, prioritized where untrusted users share the application infrastructure.

An attacker who has obtained a low-level logon to the server infrastructure hosting PeopleSoft Enterprise FIN Project Costing plants or crafts malicious content that a legitimate user of the Projects module will process. When that user (someone other than the attacker) interacts with the crafted element, the flaw triggers and grants the attacker full control over the Project Costing application. No public proof-of-concept is identified at time of analysis, and the local vector plus required user interaction make this an insider- or foothold-dependent scenario rather than remote drive-by exploitation.