PeopleSoft Enterprise HCM CVE-2026-60666

Exploitation requires a valid low-privileged account with network-level Oracle Net connectivity to the PeopleSoft HCM HR 9.2 environment, confirmed by CVSS PR:L and AV:N. The AC:H designation indicates that exploitation is difficult and depends on specific, undisclosed preconditions - Oracle does not publicly detail what configuration state, timing, or sequence is required. The 'Authentication Bypass' tag identifies the flaw as residing within the Security component, meaning the attacker uses their low-privilege session to bypass security enforcement and access data above their authorization level. Exploitation is NOT possible without at least a low-privilege Oracle Net credential; unauthenticated remote exploitation is ruled out by the CVSS vector (PR:L). No user interaction is required (UI:N). Key limiting factors: requires an existing Oracle Net credential (not a web/HTTP attack surface), requires satisfaction of unspecified AC:H preconditions reducing opportunistic risk, and is constrained to data confidentiality and integrity - no availability impact is expected.

The CVSS base score of 6.8 (Medium) reflects a tension between severe potential impact (C:H/I:H) and meaningful exploitation barriers (AC:H, PR:L). The high attack complexity indicates specific conditions - undisclosed by Oracle - must align for exploitation, materially reducing opportunistic risk. PR:L confirms that unauthenticated exploitation is not possible; a valid, low-privileged Oracle Net credential is a hard prerequisite. No EPSS score is available in the provided intelligence, preventing probabilistic exploitation likelihood assessment. The absence of a CISA KEV listing and no identified public exploit code further support a measured rather than urgent response posture. The 'Authentication Bypass' tag is somewhat in tension with PR:L: the most defensible interpretation is privilege escalation within an authenticated session rather than a fully unauthenticated attack - CVSS vector confirms this with PR:L. Real-world priority is moderate-to-high for organizations with externally or untrusted low-privileged Oracle Net users; environments with tightly restricted Oracle Net access and strong account governance face lower residual risk. CVSS indicates no availability impact (A:N), so denial-of-service scenarios are not a concern here.

An attacker holding a low-privileged PeopleSoft or Oracle Net service account - such as a junior HR analyst, a shared reporting account, or a compromised integration credential - connects to the target PeopleSoft HCM 9.2 environment over Oracle Net and triggers the Security component bypass under the specific preconditions required by AC:H, potentially a particular query pattern or privilege-check code path. Once the bypass succeeds, the attacker gains full read access to all HCM HR data and the ability to create, modify, or delete critical HR records beyond their authorized scope. No public exploit code exists at time of analysis, indicating exploitation likely requires knowledge of PeopleSoft Security component internals or Oracle Net protocol behavior specific to this flaw.