EUVD-2026-47027
GHSA-g3c9-96cj-fcm2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach PeopleSoft PIA web tier over HTTP
-
DeliverySend crafted request to French public-sector HR component
-
ExploitBypass authentication / missing authorization check
-
ExecutionRead all HR-accessible data (PII/payroll)
-
ImpactModify subset of HR records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target run Oracle PeopleSoft Enterprise HCM Human Resources 9.2 with the French Public Sector Specific component deployed and its PeopleSoft Internet Architecture web tier reachable over HTTP by the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U), no authentication, no user interaction, and no special client-side conditions are needed against an affected deployment of that component. The principal limiting factor is scope: only installations that have enabled or licensed the French public-sector HR localization are exposed, so environments without that component are not affected; attacker network reachability of the PIA is also required. |
| Impact | The signals largely align toward a real, actionable priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated, no-interaction attack, and Oracle's own 'easily exploitable' wording is a strong vendor-confirmed indicator. Impact is asymmetric - C:H (full read of HR-accessible data including PII) but only I:L (partial write) and A:N (no availability impact) - so the dominant risk is mass data disclosure rather than destruction. Tempering the priority: no EPSS score is provided, there is no POC and no CISA KEV listing (so no confirmed active exploitation), and the vulnerable code is scoped to the French Public Sector Specific localization, which sharply narrows the exposed population. The 'Authentication Bypass' label is an intel tag, not an Oracle CWE, so treat the precise mechanism as inferred rather than confirmed. Net: high severity for organizations running the French public-sector HCM module, but lower real-world breadth given the niche component and absence of exploitation evidence. |
| Exploit ScenarioDerived | An attacker able to reach the PeopleSoft web front end sends crafted HTTP requests to the French Public Sector Specific HR functionality and, without supplying valid credentials, retrieves sensitive human-resources records such as employee personal and payroll data, then uses the partial write access to alter selected records. Because Oracle rates it easily exploitable with AV:N/AC:L/PR:N/UI:N, the attack needs only network access and no user interaction; no public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Unauthorized data access in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (French Public Sector Specific component) lets a remote, unauthenticated attacker read all HR-accessible data and modify a subset of it over HTTP. Oracle's July 2026 CPU rates it easily exploitable with high confidentiality and low integrity impact (CVSS 3.1 base 8.2), and third-party intel tags it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though no discrete fix version string is published outside the CPU bundle, so map CVE-2026-60668 to the corresponding PeopleSoft HCM patch in the CPU matrix and apply it on a prioritized (high) schedule because the flaw is unauthenticated and network-reachable. Until the CPU is applied, compensating controls include restricting network access to the PeopleSoft Internet Architecture web tier so the affected French Public Sector Specific HR pages are reachable only from trusted internal networks or VPN (trade-off: breaks external HR self-service access), adding a WAF or reverse-proxy rule in front of the PIA to block or require authentication on the French public-sector component endpoints (trade-off: needs accurate URL scoping and may block legitimate localized traffic), and, if the French public-sector functionality is not used, disabling or removing that component entirely (trade-off: none functionally for non-French-public-sector deployments). Confirm exact patch identifiers against the CPU release notes before deployment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PeopleSoft Enterprise HCM Human Resources is Oracle's large-scale human capital management application, typically exposed through the PeopleSoft Internet Architecture (PIA) web tier over HTTP/HTTPS atop a PeopleTools runtime and an Oracle relational database backend. The flaw resides in the 'French Public Sector Specific' localization component, so the vulnerable code path is tied to French public-sector payroll/HR functionality rather than the core product. Oracle publishes no CWE (CWE: N/A), but the 'Authentication Bypass' tag combined with PR:N and unauthorized read/write access points to a broken-access-control / missing-authorization class defect where a request reaches sensitive HR data without a valid authenticated session. Per Oracle's CPU the affected scope is limited to PeopleSoft HCM Human Resources version 9.2.
Know when Peoplesoft Enterprise Hcm Human Resources gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Unauthenticated network HTTP attack (AV:N/AC:L/PR:N/UI:N) yielding full HR data disclosure (C:H) and partial write (I:L) with no availability impact (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: French Public Sector Specific). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Human Resources accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Human Resources accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
Executive ViewAI
Oracle PeopleSoft Enterprise HCM version 9.2 (French Public Sector Specific component) is vulnerable to unauthenticated remote access of employee data. While no public exploit is currently identified, the vulnerability is easily exploitable and exposes organizations to immediate risk of sensitive personnel record access and unauthorized HR system modifications, creating compliance liabilities and operational disruption. All instances without network-level protections are at risk.
No vendor-released patch identified at time of analysis. Interim mitigations: implement network firewall rules restricting internet-facing access to HCM systems; deploy Web Application Firewall (WAF) with mandatory authentication enforcement on all HCM endpoints; establish network segmentation isolating HCM infrastructure from untrusted networks; enable comprehensive logging and alerting of all HCM data access; develop incident response procedures for detection of unauthorized access attempts; consider temporarily disabling internet-accessible instances if operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Integrity and availability compromise in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (Core component) allows a
Oracle PeopleSoft Enterprise HCM Human Resources 9.2 exposes a Security component flaw that enables a low-privileged, ne
PeopleSoft Enterprise HCM Human Resources 9.2 exposes critical HR data to unauthorized access and modification through a
Unauthenticated attackers can exploit a cross-site request forgery vulnerability in Oracle PeopleSoft Enterprise HCM Hum
Cross-site scripting or equivalent client-side injection in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 - speci
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Human Resources)
Exploit-DB