CVE-2026-60595: PeopleSoft Pay/Bill Auth Bypass Flaw

CVE-2026-60595 Overview

CVE-2026-60595 affects the Oracle PeopleSoft Enterprise FIN Pay/Bill Management product, specifically the Paybill Management component. The vulnerability affects supported version 9.2 and allows a low-privileged attacker with logon access to the infrastructure to compromise the application. Successful exploitation results in unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Pay/Bill Management accessible data. Oracle addressed this issue in the July 2026 Critical Patch Update.

Critical Impact
An authenticated local attacker can gain unauthorized read access to all data accessible through PeopleSoft Enterprise FIN Pay/Bill Management, exposing sensitive financial and billing information.

Affected Products

Oracle PeopleSoft Enterprise FIN Pay/Bill Management 9.2
Component: Paybill Management
Deployments running the unpatched July 2026 CPU baseline

Discovery Timeline

2026-07-21 - CVE-2026-60595 published to NVD
2026-07-21 - Last updated in NVD database
Referenced in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-60595

Vulnerability Analysis

CVE-2026-60595 is an information disclosure vulnerability in the Paybill Management component of Oracle PeopleSoft Enterprise FIN Pay/Bill Management. The flaw permits an authenticated user with low privileges to read data that should require higher authorization. The impact is limited to confidentiality, with integrity and availability unaffected. Oracle categorizes the vulnerability as easily exploitable but requires local access to the infrastructure where the application executes.

Because Pay/Bill Management processes financial transactions, customer billing records, and payroll-adjacent data, unauthorized read access can expose payment details, invoice records, and account balances. The EPSS score stands at 0.151% (4.764 percentile), indicating no active exploitation prediction at publication.

Root Cause

Oracle's advisory does not disclose implementation-level detail. The scope-unchanged, confidentiality-only impact profile is consistent with a broken access control or missing authorization check within Paybill Management that permits an authenticated user to read records outside their intended data scope.

Attack Vector

The attacker must first authenticate to the infrastructure hosting PeopleSoft Enterprise FIN Pay/Bill Management. With low-privilege credentials, the attacker interacts with the Paybill Management component to enumerate or retrieve data outside the assigned entitlement boundary. No user interaction is required and attack complexity is low. Because the attack vector is local rather than network-facing, exposure is bounded by which principals can already log on to the affected environment.

No public proof-of-concept exploit has been published. Technical detail is limited to the Oracle Critical Patch Update Advisory - July 2026.

Detection Methods for CVE-2026-60595

Indicators of Compromise

Unusual queries or navigation by low-privileged accounts against Paybill Management pages and components
Bulk retrieval of billing, invoice, or payment records outside a user's business unit or department scope
Access to Paybill Management functionality from accounts that historically use only unrelated PeopleSoft modules

Detection Strategies

Enable PeopleSoft audit logging (PSAUDIT, database-level auditing) on Pay/Bill Management tables and review access patterns per user role
Baseline normal query volume and record counts per user, then alert on statistical outliers
Correlate application access logs with host authentication logs to identify low-privilege accounts touching sensitive financial data

Monitoring Recommendations

Forward PeopleSoft application, web, and database logs into a centralized SIEM for retention and correlation
Alert on privilege-tier mismatches: low-privileged roles reading data owned by higher-privileged roles
Track process and session activity on the infrastructure hosting PeopleSoft to detect lateral movement toward the Pay/Bill Management tier

How to Mitigate CVE-2026-60595

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update - July 2026 to all PeopleSoft Enterprise FIN Pay/Bill Management 9.2 instances
Inventory all accounts with logon access to PeopleSoft infrastructure and remove unnecessary local access
Review Paybill Management role definitions and permission lists, removing excess data access from low-privileged roles

Patch Information

Oracle released remediation as part of the July 2026 Critical Patch Update. Administrators must download and apply the PeopleSoft-specific patch bundle from My Oracle Support and validate the fix in a non-production environment before rolling to production. Patch precedence should follow Oracle's documented order to avoid regressions in dependent modules.

Workarounds

Restrict logon access to PeopleSoft application and database servers to a minimal set of administrators and service accounts
Enforce least-privilege on PeopleSoft roles, permission lists, and row-level security for Pay/Bill Management data
Require multi-factor authentication for all interactive logons to hosts running PeopleSoft components
Segment the PeopleSoft infrastructure network so only authorized jump hosts can initiate sessions to it

bash

# Configuration example: audit read access on PeopleSoft Pay/Bill Management tables (Oracle DB)
AUDIT SELECT ON SYSADM.PS_BI_HDR BY ACCESS;
AUDIT SELECT ON SYSADM.PS_BI_LINE BY ACCESS;
AUDIT SELECT ON SYSADM.PS_PAYMENT_TBL BY ACCESS;

# Review audit trail
SELECT username, obj_name, action_name, timestamp
  FROM dba_audit_trail
 WHERE obj_name IN ('PS_BI_HDR','PS_BI_LINE','PS_PAYMENT_TBL')
   AND timestamp > SYSDATE - 7
 ORDER BY timestamp DESC;