CVE-2026-60606: PeopleSoft Auth Bypass Vulnerability

CVE-2026-60606 Overview

CVE-2026-60606 is a critical vulnerability in the Oracle PeopleSoft Enterprise CC Common Application Objects product, affecting the Common Application Objects component. The supported version affected is 9.2. An unauthenticated attacker with network access via HTTP can exploit this flaw to compromise the application. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all data accessible through PeopleSoft Enterprise CC Common Application Objects. Oracle disclosed the issue in its July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can read, modify, or delete critical PeopleSoft data over HTTP without user interaction.

Affected Products

Oracle PeopleSoft Enterprise CC Common Application Objects 9.2
Component: Common Application Objects
Deployments exposing the PeopleSoft HTTP interface to untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-60606 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in Oracle Security Alert July 2026

Technical Details for CVE-2026-60606

Vulnerability Analysis

The vulnerability resides in the Common Application Objects component of Oracle PeopleSoft Enterprise CC Common Application Objects 9.2. Oracle characterizes the issue as easily exploitable over the network via HTTP without authentication or user interaction. Successful exploitation yields high confidentiality and integrity impact against the application scope.

The attacker gains the ability to read all data accessible to the affected component and to create, modify, or delete records. PeopleSoft Common Application Objects underpin shared services used across PeopleSoft applications, so compromise can propagate to downstream modules that reference the same data structures.

Availability is not directly impacted, which suggests the flaw enables data-layer manipulation rather than a service crash. The EPSS score is 0.398% at the 32.3 percentile as of 2026-07-23.

Root Cause

Oracle has not published a detailed root cause analysis for CVE-2026-60606. Based on the exploitation profile — unauthenticated network access via HTTP producing high confidentiality and integrity impact — the flaw is consistent with a broken access control or missing authorization defect in an HTTP-facing endpoint of the Common Application Objects component. Refer to the Oracle Security Alert July 2026 for vendor guidance.

Attack Vector

The attack vector is network-based. An attacker sends crafted HTTP requests to the exposed PeopleSoft application interface. No credentials, privileges, or user interaction are required. The scope remains unchanged, meaning the impact is contained within the vulnerable component, but that component provides broad access to shared PeopleSoft data.

Internet-exposed PeopleSoft portals are the primary target surface. Internal deployments are also at risk from attackers who have obtained network foothold on adjacent segments.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported at time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60606

Indicators of Compromise

Unexpected HTTP requests to PeopleSoft Common Application Objects endpoints from external or unusual internal sources
Anomalous creation, modification, or deletion events in PeopleSoft audit tables without an associated authenticated session
HTTP requests containing unusual parameters or payloads targeting Common Application Objects URIs
Access to sensitive PeopleSoft records outside of normal business hours or from unfamiliar user agents

Detection Strategies

Enable and review PeopleSoft application server access logs for unauthenticated requests reaching authenticated resources
Correlate web server, application server, and database audit logs to identify data changes lacking a valid session context
Deploy web application firewall rules to alert on anomalous request patterns against /psp/ and /psc/ PeopleSoft URIs
Baseline normal API and portal traffic volumes and alert on deviations following the July 2026 Oracle CPU disclosure

Monitoring Recommendations

Forward PeopleSoft, web server, and database logs to a centralized SIEM for correlation and long-term retention
Monitor for outbound connections from the PeopleSoft application server that follow suspicious inbound HTTP activity
Track privileged data access patterns against Common Application Objects tables and flag unauthenticated origin sessions

How to Mitigate CVE-2026-60606

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fixes to PeopleSoft Enterprise 9.2 as soon as maintenance windows allow
Inventory all PeopleSoft deployments and identify any instance exposing HTTP interfaces to untrusted networks
Restrict network access to PeopleSoft portals to trusted sources, VPN, or reverse proxies with authentication
Review recent audit logs for suspicious data modifications or reads against Common Application Objects

Patch Information

Oracle addressed CVE-2026-60606 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 advisory for the specific PeopleSoft Enterprise 9.2 patch bundles, prerequisites, and application instructions. Apply patches in a staging environment first to validate compatibility with local customizations before production rollout.

Workarounds

Place the PeopleSoft portal behind a web application firewall configured to block unauthenticated access to sensitive endpoints
Enforce network segmentation and remove direct internet exposure of PeopleSoft application servers where feasible
Require VPN or zero-trust access broker authentication before HTTP traffic reaches the PeopleSoft tier
Increase audit logging on Common Application Objects tables until the vendor patch is fully deployed

bash

# Configuration example: restrict PeopleSoft portal access at the reverse proxy
# Example nginx snippet - adapt to your environment
location /psp/ {
    allow 10.0.0.0/8;      # internal corporate range
    allow 192.168.0.0/16;  # VPN pool
    deny all;
    proxy_pass http://peoplesoft_backend;
}