CVE-2026-60597: PeopleSoft Cash Management Auth Bypass

CVE-2026-60597 Overview

CVE-2026-60597 is a network-exploitable vulnerability in the Oracle PeopleSoft Enterprise FIN Cash Management product, specifically within the Cash Management component. The flaw affects supported version 9.2 and allows an unauthenticated attacker with HTTP access to compromise the application. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, and full read access to all data accessible through PeopleSoft Enterprise FIN Cash Management. The vulnerability carries a scope change, meaning attacks can significantly impact additional Oracle products beyond the vulnerable component itself.

Critical Impact
Unauthenticated network attackers can read, modify, or delete all data accessible through PeopleSoft Enterprise FIN Cash Management, with impact extending to adjacent Oracle products through scope change.

Affected Products

Oracle PeopleSoft Enterprise FIN Cash Management 9.2
Oracle PeopleSoft Cash Management component
Downstream Oracle products impacted through scope change

Discovery Timeline

2026-07-21 - CVE CVE-2026-60597 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update

Technical Details for CVE-2026-60597

Vulnerability Analysis

The vulnerability resides in the Cash Management component of Oracle PeopleSoft Enterprise Financials. An attacker reaches the vulnerable code path over HTTP without authenticating to the application. The affected version is PeopleSoft Enterprise FIN Cash Management 9.2.

Exploitation is described by Oracle as difficult, requiring specific conditions beyond the attacker's direct control. Once those conditions align, the attacker gains the ability to create, delete, or modify data handled by Cash Management. The attacker also gains read access to every record that Cash Management can reach.

The vulnerability produces a scope change. Impact is not confined to Cash Management and can propagate to additional Oracle components integrated with the PeopleSoft financials stack. Availability of the target is not affected, based on the published CVSS vector.

Root Cause

Oracle has not published root cause details in the public advisory. The Critical Patch Update entry classifies the issue as a Cash Management component flaw reachable over HTTP without credentials. No CWE identifier is assigned in the current NVD record.

Attack Vector

The attack vector is network-based over HTTP. The attacker requires no prior authentication and no user interaction. The exploit path targets the PeopleSoft Cash Management web-facing interface. Because scope changes to other subsystems, successful attacks can pivot into data owned by adjacent Oracle products in the same deployment.

No public proof-of-concept exploit has been observed. The EPSS probability is 0.318% with a percentile of 24.056 as of the July 2026 scoring date, indicating no near-term prediction of active exploitation.

Detection Methods for CVE-2026-60597

Indicators of Compromise

Unauthenticated HTTP requests to Cash Management servlets or IScript endpoints from external or unexpected internal sources.
Unexplained creation, modification, or deletion of Cash Management records outside normal business workflows.
PeopleSoft application server or web server logs showing anomalous session initialization without prior sign-on events.
Cross-module data reads originating from Cash Management contexts that lack a corresponding user transaction.

Detection Strategies

Enable and centrally forward PeopleSoft PIA web server access logs, application server (Tuxedo) logs, and database audit logs for correlation.
Baseline normal HTTP request patterns to /psc/ and /psp/ URLs targeting Cash Management pages and alert on deviations.
Deploy web application firewall (WAF) rules that inspect for anomalous parameter values submitted to Cash Management endpoints.
Monitor database audit trails for direct data manipulation language (DML) operations against Cash Management tables outside of expected batch windows.

Monitoring Recommendations

Track authentication state transitions and flag Cash Management transactions executed without an associated authenticated PS_TOKEN.
Alert on outbound scope-changing calls from Cash Management processes into other PeopleSoft modules.
Retain HTTP request bodies for Cash Management endpoints long enough to support post-incident forensic review.

How to Mitigate CVE-2026-60597

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all PeopleSoft Enterprise FIN Cash Management 9.2 environments as the primary remediation.
Restrict internet-facing exposure of the PeopleSoft Internet Architecture (PIA) so that Cash Management URLs are not reachable from untrusted networks.
Audit Cash Management data for unauthorized creation, modification, or deletion since the environment was last known to be clean.
Rotate credentials and integration keys used by Cash Management if compromise cannot be ruled out.

Patch Information

Oracle addressed CVE-2026-60597 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update Advisory - July 2026 for the exact patch identifiers, prerequisites, and installation guidance for PeopleSoft Enterprise 9.2. Apply the update in a non-production environment first and validate Cash Management workflows before promoting to production.

Workarounds

Place the PeopleSoft PIA behind an authenticating reverse proxy or VPN to eliminate anonymous HTTP reachability until the patch is applied.
Use WAF rules to block unauthenticated requests to Cash Management component paths.
Apply network segmentation to isolate the PeopleSoft application, web, and database tiers from general user network zones.
Increase auditing on Cash Management tables and integration brokers so that any exploitation attempt is captured for review.

bash

# Example: restrict Cash Management URL paths at an nginx reverse proxy
# until the July 2026 CPU is applied
location ~* ^/(psc|psp)/[^/]+/EMPLOYEE/ERP/c/PROCESS_CASH_MGMT {
    satisfy all;
    allow 10.0.0.0/8;      # internal finance subnet
    deny  all;
    auth_request /auth;    # require authenticated session
    proxy_pass http://peoplesoft_pia_upstream;
}