What is the CVSS score of EUVD-2026-46964?

EUVD-2026-46964 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Peoplesoft Enterprise Cc Common Application Objects are affected by EUVD-2026-46964?

A critical authentication bypass in Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 allows unauthenticated remote attackers to read, modify, and delete critical business data over…

How to fix or mitigate EUVD-2026-46964?

Within 24 hours: Inventory all Oracle PeopleSoft Enterprise CC 9.2 instances and assess internet exposure; immediately implement network-level restrictions to limit HTTP/HTTPS access to trusted internal networks and authorized users only. Within 7 days: Deploy web application firewall rules to detect and block exploitation attempts against PeopleSoft endpoints; enable enhanced logging and alerting for data access anomalies. Within 30 days: Establish regular communication with Oracle to track patch availability timelines; develop and test a migration or upgrade plan for all affected PeopleSoft 9.2 systems, prioritizing internet-facing deployments.

Peoplesoft Enterprise Cc Common Application Objects EUVD-2026-46964

| CVE-2026-60606 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-v54x-x97w-hjg8

Authentication Bypass Oracle Peoplesoft Enterprise Cc Common Application Objects

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:24 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Common Application Objects). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CC Common Application Objects accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle PeopleSoft Enterprise CC Common Application Objects 9.2 allows a remote, unauthenticated attacker to read, create, modify, or delete critical application data over HTTP. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact), making it easily exploitable without user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patching target.