What is the CVSS score of CVE-2026-60667?

CVE-2026-60667 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of PeopleSoft HCM are affected by CVE-2026-60667?

Oracle PeopleSoft Enterprise HCM 9.2 contains a high-severity vulnerability permitting unauthenticated network attackers to modify or delete critical employee records and disable HR operations…

How to fix or mitigate CVE-2026-60667?

Within 24 hours, identify all PeopleSoft HCM 9.2 systems and restrict network access to trusted internal networks only, blocking direct internet and untrusted source exposure. Within 7 days, enforce mandatory authentication at the network perimeter using a reverse proxy or bastion host, enable comprehensive audit logging on all employee data modifications, and configure real-time alerting on unauthorized access attempts. Within 30 days, apply the Oracle July 2026 Critical Patch Update once released, or coordinate an expedited upgrade to a patched version if available sooner.

PeopleSoft HCM CVE-2026-60667

EUVD-2026-47026 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-h726-8p4h-6955

Authentication Bypass Oracle Peoplesoft Enterprise Hcm Human Resources

7.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

7.4 HIGH

Unauthenticated network TCP reach gives AV:N/PR:N/UI:N; 'difficult to exploit' justifies AC:H; no data disclosure means C:N with high integrity and availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:56 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.4

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Core). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Human Resources accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise HCM Human Resources. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).

AnalysisAI

Integrity and availability compromise in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (Core component) allows a network-based, unauthenticated attacker to create, delete or modify critical data and to trigger a complete, repeatable denial of service. The flaw is rated CVSS 7.4 and is fixed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis, and confidentiality is not impacted. Despite requiring no authentication, the CVSS vector flags high attack complexity (AC:H), which meaningfully raises the bar for reliable exploitation.

Technical ContextAI

Oracle PeopleSoft Enterprise HCM is a large web/application-tier ERP suite for human-resources management, historically built on the PeopleTools application server (Tuxedo/WebLogic-fronted) and reachable over TCP. This CVE resides in the Core component of the HCM Human Resources module in the 9.2 release line. Oracle did not assign a CWE (CWE: N/A) and does not publish exploitation details, so the precise root-cause class (e.g., input validation, deserialization, or logic flaw) cannot be determined from the available data; the impact profile - integrity and availability but not confidentiality - is consistent with a data-manipulation and service-crash weakness rather than an information-disclosure bug.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); this is patch available per vendor advisory, as Oracle CPUs ship cumulative security patches rather than a single named product version, so consult the CPU matrix for the exact PeopleSoft/PeopleTools patch level for your deployment. No specific fixed build number was provided in the input, so do not assume a version string not listed by Oracle. Until patching completes, reduce exposure by restricting network reachability of the PeopleSoft application and web tiers to trusted management/HR networks (VPN or IP allow-listing), placing the service behind a reverse proxy or WAF, and blocking direct TCP access from untrusted segments; the trade-off is that overly aggressive network filtering can disrupt legitimate integrations (payroll feeds, SSO, batch jobs), so validate connectivity for those flows before enforcing.