What is the CVSS score of CVE-2026-60668?

CVE-2026-60668 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle PeopleSoft HCM are affected by CVE-2026-60668?

Oracle PeopleSoft Enterprise HCM version 9.2 (French Public Sector Specific component) is vulnerable to unauthenticated remote access of employee data.

How to fix or mitigate CVE-2026-60668?

Within 24 hours: Identify all systems running Oracle PeopleSoft Enterprise HCM 9.2 (French Public Sector Specific component) and assess their internet accessibility. Within 7 days: Implement firewall rules to restrict HTTP/HTTPS access from untrusted networks, or if business operations require internet access, deploy a Web Application Firewall (WAF) configured to enforce authentication checks; immediately contact Oracle support to confirm patch timeline and interim guidance availability. Within 30 days: Monitor Oracle security advisories for patch announcements; establish parallel testing of patches in non-production environments; maintain enhanced logging and real-time alerting on HCM system access for incident detection.

Oracle PeopleSoft HCM CVE-2026-60668

EUVD-2026-47027 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-g3c9-96cj-fcm2

Authentication Bypass Oracle Peoplesoft Enterprise Hcm Human Resources

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Unauthenticated network HTTP attack (AV:N/AC:L/PR:N/UI:N) yielding full HR data disclosure (C:H) and partial write (I:L) with no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:56 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: French Public Sector Specific). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Human Resources accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Human Resources accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Unauthorized data access in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (French Public Sector Specific component) lets a remote, unauthenticated attacker read all HR-accessible data and modify a subset of it over HTTP. Oracle's July 2026 CPU rates it easily exploitable with high confidentiality and low integrity impact (CVSS 3.1 base 8.2), and third-party intel tags it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

PeopleSoft Enterprise HCM Human Resources is Oracle's large-scale human capital management application, typically exposed through the PeopleSoft Internet Architecture (PIA) web tier over HTTP/HTTPS atop a PeopleTools runtime and an Oracle relational database backend. The flaw resides in the 'French Public Sector Specific' localization component, so the vulnerable code path is tied to French public-sector payroll/HR functionality rather than the core product. Oracle publishes no CWE (CWE: N/A), but the 'Authentication Bypass' tag combined with PR:N and unauthorized read/write access points to a broken-access-control / missing-authorization class defect where a request reaches sensitive HR data without a valid authenticated session. Per Oracle's CPU the affected scope is limited to PeopleSoft HCM Human Resources version 9.2.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though no discrete fix version string is published outside the CPU bundle, so map CVE-2026-60668 to the corresponding PeopleSoft HCM patch in the CPU matrix and apply it on a prioritized (high) schedule because the flaw is unauthenticated and network-reachable. Until the CPU is applied, compensating controls include restricting network access to the PeopleSoft Internet Architecture web tier so the affected French Public Sector Specific HR pages are reachable only from trusted internal networks or VPN (trade-off: breaks external HR self-service access), adding a WAF or reverse-proxy rule in front of the PIA to block or require authentication on the French public-sector component endpoints (trade-off: needs accurate URL scoping and may block legitimate localized traffic), and, if the French public-sector functionality is not used, disabling or removing that component entirely (trade-off: none functionally for non-French-public-sector deployments). Confirm exact patch identifiers against the CPU release notes before deployment.