CVE-2026-60665: PeopleSoft HCM Auth Bypass Vulnerability

CVE-2026-60665 Overview

CVE-2026-60665 affects Oracle PeopleSoft Enterprise Human Capital Management (HCM) Global Payroll Switzerland version 9.2. The flaw resides in the Global Payroll for Switzerland component and allows a low-privileged attacker with network access via HTTP to compromise the application. Successful exploitation results in unauthorized read, create, delete, or modify access to critical data across the affected product.

The vulnerability carries a scope-change characteristic, meaning attacks initiated against Global Payroll for Switzerland can affect additional Oracle products beyond the vulnerable component. Oracle addressed this issue in the Critical Patch Update published in July 2026.

Critical Impact
An authenticated attacker can read and modify sensitive payroll data across trust boundaries, impacting confidentiality and integrity of HR and payroll records.

Affected Products

Oracle PeopleSoft Enterprise HCM Global Payroll Switzerland 9.2
Global Payroll for Switzerland component
Deployments exposing PeopleSoft HCM over HTTP

Discovery Timeline

2026-07-21 - CVE-2026-60665 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses issue in Critical Patch Update (CPU) advisory

Technical Details for CVE-2026-60665

Vulnerability Analysis

The vulnerability exists in the Global Payroll for Switzerland component of Oracle PeopleSoft Enterprise HCM. An attacker requires authenticated access with low privileges and network reachability to the HTTP interface of the PeopleSoft application. Exploitation is rated as difficult, indicating specialized conditions or timing must be met.

Oracle classifies the impact as affecting confidentiality and integrity, with no impact on availability. The scope-change attribute in the CVSS vector indicates the vulnerable component can affect resources beyond its own security authority. This behavior is typical of vulnerabilities that cross application boundaries within the PeopleSoft Internet Architecture (PIA) stack.

Because PeopleSoft HCM handles payroll records, employee compensation, and personally identifiable information (PII), a successful attack can compromise sensitive Swiss payroll data and adjacent PeopleSoft modules.

Root Cause

Oracle has not disclosed the specific root cause in public advisories. Based on the CVSS vector and affected component, the flaw allows a low-privileged authenticated session to perform actions that reach data outside the intended trust boundary of Global Payroll for Switzerland.

Attack Vector

Exploitation requires network access to the PeopleSoft HTTP service and a valid low-privileged account. No user interaction is required. The attacker sends crafted HTTP requests to the Global Payroll for Switzerland component to trigger unauthorized data access or modification. Refer to the Oracle Security Alert CPU July 2026 for detailed technical context.

Detection Methods for CVE-2026-60665

Indicators of Compromise

Unexpected HTTP requests to Global Payroll for Switzerland endpoints from low-privileged user sessions
Anomalous read or write operations against payroll tables outside normal business hours
Session activity where a single low-privileged account touches data belonging to other PeopleSoft modules

Detection Strategies

Enable PeopleSoft application server auditing on the GP_CH component and correlate audit records with authentication logs
Baseline expected HTTP request patterns to Global Payroll for Switzerland URLs and alert on deviations
Review database audit logs for cross-module data access originating from Global Payroll for Switzerland service accounts

Monitoring Recommendations

Forward PeopleSoft PIA web server, application server, and database logs to a centralized SIEM for correlation
Track privilege usage patterns for low-privileged HCM roles and alert on scope escalation
Monitor egress traffic from PeopleSoft servers for unauthorized data staging or exfiltration

How to Mitigate CVE-2026-60665

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all PeopleSoft Enterprise HCM 9.2 environments running Global Payroll for Switzerland
Inventory PeopleSoft HCM deployments and confirm patch level against the Oracle CPU advisory
Restrict network access to the PeopleSoft HTTP interface to trusted network segments and VPN users

Patch Information

Oracle released fixes as part of the Critical Patch Update published in July 2026. Administrators must consult the Oracle Security Alert CPU July 2026 for the applicable patch bundles, prerequisite steps, and post-installation validation guidance for PeopleSoft HCM 9.2.

Workarounds

Disable the Global Payroll for Switzerland component if it is not in use within your PeopleSoft deployment
Enforce least-privilege role assignments so low-privileged accounts cannot reach the affected endpoints
Place a web application firewall (WAF) in front of the PeopleSoft PIA to filter anomalous HTTP requests targeting GP_CH URLs

bash

# Configuration example
# Restrict access to Global Payroll for Switzerland URLs at the reverse proxy
location ~* /psc/.*/EMPLOYEE/HRMS/c/GP_CH.* {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://peoplesoft_backend;
}