PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60666 Oracle Corporation CVE debrief

The CVE-2026-60666 vulnerability is a difficult-to-exploit issue in Oracle PeopleSoft Enterprise HCM Human Resources version 9.2. It allows low privileged attackers with network access via Oracle Net to compromise the system. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all PeopleSoft Enterprise HCM Human Resources accessible data, as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Human Resources accessible data. The CVSS 3.1 Base Score is 6.8, indicating medium severity, with Confidentiality and Integrity impacts. This vulnerability affects Oracle PeopleSoft Enterprise HCM Human Resources version 9.2. To address this vulnerability, it is essential to review and apply Oracle's security patches for PeopleSoft Enterprise HCM Human Resources version 9.2. Additionally, implementing compensating controls to restrict network access to Oracle Net and monitoring PeopleSoft Enterprise HCM Human Resources systems for suspicious activity can help mitigate the risk.

Vendor
Oracle Corporation
Product
PeopleSoft Enterprise HCM Human Resources
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-08-03
Advisory published
2026-07-21
Advisory updated
2026-08-03

Who should care

Oracle PeopleSoft Enterprise HCM Human Resources administrators, IT security teams responsible for Oracle products, and organizations using PeopleSoft Enterprise HCM Human Resources version 9.2.

Technical summary

The CVE-2026-60666 vulnerability is a difficult-to-exploit issue in Oracle PeopleSoft Enterprise HCM Human Resources version 9.2. It allows low privileged attackers with network access via Oracle Net to compromise the system. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all PeopleSoft Enterprise HCM Human Resources accessible data, as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Human Resources accessible data. The CVSS 3.1 Base Score is 6.8, indicating medium severity, with Confidentiality and Integrity impacts.

Defensive priority

Medium severity vulnerability in Oracle PeopleSoft Enterprise HCM Human Resources, requiring low privileged attacker with network access via Oracle Net.

Recommended defensive actions

  • Review and apply Oracle's security patches for PeopleSoft Enterprise HCM Human Resources version 9.2.
  • Implement compensating controls to restrict network access to Oracle Net.
  • Monitor PeopleSoft Enterprise HCM Human Resources systems for suspicious activity.
  • Verify and enforce proper authentication and authorization mechanisms.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE-2026-60666 vulnerability affects Oracle PeopleSoft Enterprise HCM Human Resources version 9.2. Difficult to exploit, it allows low privileged attackers with network access via Oracle Net to compromise the system, potentially leading to unauthorized creation, deletion, or modification of critical data. The CVSS 3.1 Base Score is 6.8, indicating medium severity.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:07.500Z and has not been modified since then.