What is the CVSS score of CVE-2026-60666?

CVE-2026-60666 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

PeopleSoft Enterprise HCM CVE-2026-60666

EUVD-2026-47025 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-rgq8-3qjq-2mh6

Authentication Bypass Oracle Peoplesoft Enterprise Hcm Human Resources

6.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.8 MEDIUM

Network vector via Oracle Net with low-privilege credential required; AC:H reflects unspecified but difficult preconditions; C:H and I:H confirmed by full data access impact; A:N as no availability impact described.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:59 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via Oracle Net to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Human Resources accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Human Resources accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Oracle PeopleSoft Enterprise HCM Human Resources 9.2 exposes a Security component flaw that enables a low-privileged, network-accessible attacker to bypass access controls via Oracle Net, resulting in complete confidentiality and integrity compromise of all HCM HR data. The vulnerability permits unauthorized creation, deletion, and modification of critical HR records alongside full read access to all accessible data within the system. No public exploit has been identified at time of analysis, and the CVSS AC:H designation indicates specific, undisclosed preconditions must be met for successful exploitation.

Technical ContextAI

The vulnerability resides within the Security component of Oracle PeopleSoft Enterprise HCM Human Resources 9.2, accessible over Oracle Net - Oracle's proprietary database networking protocol (formerly SQL*Net), typically operating over TCP port 1521. The 'Authentication Bypass' tag applied by the reporter suggests the flaw allows a low-privileged authenticated session to circumvent security enforcement logic within the PeopleSoft security layer, effectively escalating effective data access beyond granted permissions. No CWE was assigned, but the pattern is consistent with improper authorization enforcement, insecure privilege validation, or flawed access control at the database or middleware tier. Oracle Net as the attack surface implies the vulnerability may be exploitable directly at the database or PeopleSoft application server layer rather than the web/browser interface. The affected version is confirmed as 9.2 per EUVD-2026-47025 and Oracle's July 2026 CPU advisory.

RemediationAI

Organizations should apply Oracle's Critical Patch Update for July 2026, available through the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched build or release number is not independently confirmed from the available intelligence; customers must consult Oracle's patch availability matrix and My Oracle Support for the applicable PeopleSoft 9.2 patch bundle. As a compensating control pending patch application, restrict Oracle Net (TCP 1521 by default) access to the PeopleSoft HCM environment at the network layer, limiting connectivity exclusively to authorized application servers and administrative hosts - this reduces the effective attack surface from broad network accessibility to a controlled set of trusted systems, though it may impact legitimate integrations that rely on direct Oracle Net connectivity. Additionally, audit and minimize the number of low-privileged accounts with Oracle Net access to the HCM system, as PR:L exploitation requires a valid credential. Do not treat network restrictions alone as a permanent fix; patch application remains the authoritative remediation.