PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60600 Oracle Corporation CVE debrief

A high-severity vulnerability exists in Oracle PeopleSoft Enterprise FIN Project Costing, specifically in the Projects component of version 9.2. The vulnerability, tracked as CVE-2026-60600, has a CVSS score of 7.8 and can allow an unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Project Costing executes to compromise the system. Successful attacks require human interaction from a person other than the attacker and can result in takeover of PeopleSoft Enterprise FIN Project Costing.

Vendor
Oracle Corporation
Product
PeopleSoft Enterprise FIN Project Costing
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-27
Advisory published
2026-07-21
Advisory updated
2026-07-27

Who should care

Organizations using Oracle PeopleSoft Enterprise FIN Project Costing version 9.2 should prioritize patching this vulnerability to prevent potential takeover of the system. This includes reviewing and updating access controls, monitoring system logs for potential exploitation attempts, and implementing additional security measures to detect and prevent human interaction with the system.

Technical summary

The vulnerability is located in the Projects component of PeopleSoft Enterprise FIN Project Costing version 9.2. It is easily exploitable and requires human interaction from a person other than the attacker. Successful attacks can result in takeover of PeopleSoft Enterprise FIN Project Costing. The CVSS Vector is (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Organizations should focus on patching due to high severity and potential system compromise. Evidence from the CVE record and NVD detail page confirms the vulnerability's existence and impact. Reviewing system logs and implementing additional security measures can help detect and prevent human interaction with the system.

Defensive priority

High priority should be given to patching this vulnerability due to its high CVSS score and potential impact on the system.

Recommended defensive actions

  • Apply the patch provided by Oracle as soon as possible
  • Review and update access controls to prevent unauthorized access
  • Monitor system logs for potential exploitation attempts
  • Implement additional security measures to detect and prevent human interaction with the system
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-21T22:18:00.180Z and was last modified on 2026-07-27T16:18:09.110Z. The NVD entry is currently Awaiting Analysis. This vulnerability affects Oracle PeopleSoft Enterprise FIN Project Costing version 9.2. The vulnerability is located in the Projects component and has a CVSS score of 7.8. The CVSS Vector is (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:00.180Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.