PeopleSoft HCM CVE-2026-60667

Exploitation requires TCP network access to the PeopleSoft Enterprise HCM Human Resources 9.2 Core service and does not require authentication or user interaction (PR:N/UI:N). The dominant limiting factor is the high attack complexity (AC:H) - Oracle explicitly labels this 'difficult to exploit,' implying conditions outside the attacker's direct control (such as specific timing, state, or configuration) must be met for a successful attack. Realistic exposure is therefore constrained to environments where the PeopleSoft tier is reachable from the attacker's network position and where those complexity preconditions can be satisfied; the affected build must be the supported 9.2 line prior to the July 2026 CPU fix.

The signals are partially conflicting and should be weighed carefully. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H = 7.4 High) shows an unauthenticated, network-reachable issue with high integrity and availability impact, which argues for prioritization on internet- or intranet-exposed HR systems. However, the AC:H metric - reinforced by Oracle's own description calling it 'difficult to exploit' - indicates non-trivial preconditions or a hard-to-win race/state that reduces real-world weaponization likelihood. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is currently no evidence of active or imminent mass exploitation; the risk is best characterized as a credible-but-not-urgent threat where exposure of the PeopleSoft tier to untrusted networks is the dominant risk driver. No CWE and no SSVC decision data were supplied, limiting automated triage precision.

An attacker with network reachability to a PeopleSoft HCM 9.2 endpoint sends crafted TCP requests to the vulnerable Core component without needing any credentials, and after overcoming the high-complexity preconditions is able to tamper with or delete critical HR records or force a repeatable crash that takes the HR system offline. Because the vector is network-based and unauthenticated, an exposed or insufficiently segmented deployment is the key enabler; no public POC has been identified, which raises the practical effort required.