CVE-2026-60667 Overview
CVE-2026-60667 affects the Core component of Oracle PeopleSoft Enterprise Human Capital Management (HCM) Human Resources version 9.2. The vulnerability allows an unauthenticated attacker with network access via TCP to compromise the application. Successful exploitation permits unauthorized creation, deletion, or modification of critical HCM data and can cause a hang or repeatable crash resulting in a complete denial of service. Oracle disclosed the issue in the July 2026 Critical Patch Update. The attack complexity is high, but no privileges or user interaction are required.
Critical Impact
Unauthenticated network attackers can tamper with all PeopleSoft HCM Human Resources data and trigger a complete denial of service against the application.
Affected Products
- Oracle PeopleSoft Enterprise HCM Human Resources 9.2
- Component: Core
- Deployments exposing PeopleSoft HCM over TCP-accessible networks
Discovery Timeline
- 2026-07-21 - CVE-2026-60667 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Addressed in the Oracle Security Alert July 2026
Technical Details for CVE-2026-60667
Vulnerability Analysis
The vulnerability resides in the Core component of Oracle PeopleSoft Enterprise HCM Human Resources 9.2. An attacker reaches the flaw over TCP without authentication or user interaction. Successful exploitation grants write-level access to data managed by the HCM application, enabling record creation, modification, and deletion across the accessible dataset. The same code path also permits the attacker to force the application into a hung state or a repeatable crash, producing a complete outage.
The scope remains unchanged, and confidentiality is not directly impacted. Integrity and availability, however, are fully compromised. Oracle rates exploit complexity as high, which suggests specific conditions, timing, or preconditions must be satisfied for reliable exploitation. Oracle has not published root-cause internals; refer to the Oracle Security Alert July 2026 for vendor guidance.
Root Cause
Oracle has not disclosed the underlying defect class in the Core component. The impact profile of full integrity loss combined with a repeatable crash is consistent with improper input validation or improper access control on a network-reachable interface. Public technical detail is limited to the vendor advisory.
Attack Vector
The attacker sends crafted traffic to a network-exposed PeopleSoft HCM service over TCP. No account, credential, or user action is required. The high attack complexity indicates that the request must satisfy non-trivial conditions to trigger the flaw. See the Oracle Security Alert July 2026 for the authoritative description.
No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The current EPSS probability is 0.351%.
Detection Methods for CVE-2026-60667
Indicators of Compromise
- Unexpected creation, modification, or deletion of records within PeopleSoft HCM Human Resources tables that do not map to a corresponding authenticated user session.
- Application server hangs or repeated PeopleSoft process crashes correlated with inbound TCP traffic from untrusted sources.
- Anomalous audit log gaps or truncated transaction records within the HCM Core component.
Detection Strategies
- Enable and centralize PeopleSoft application server, web server, and database audit logs, and alert on data modifications lacking a valid authenticated session ID.
- Monitor for repeated TCP connections to PeopleSoft listener ports from a single source followed by application crashes or restarts.
- Baseline normal HCM data-change velocity and alert on statistically abnormal write bursts to sensitive HR tables.
Monitoring Recommendations
- Forward PeopleSoft, Tuxedo, and database logs to a SIEM and correlate write operations with authenticated session context.
- Track PeopleSoft process health metrics and generate alerts on unexpected restarts or worker pool exhaustion.
- Review network telemetry for direct external access to PeopleSoft application-tier ports that should be restricted to internal segments.
How to Mitigate CVE-2026-60667
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update fixes for PeopleSoft Enterprise HCM Human Resources 9.2 as documented in the Oracle Security Alert July 2026.
- Inventory all PeopleSoft HCM 9.2 instances, including test and staging environments, and confirm patch status.
- Restrict TCP access to PeopleSoft application-tier services to trusted management networks and VPN users only.
- Review recent HR data modifications and audit logs for signs of tampering prior to patching.
Patch Information
Oracle addressed CVE-2026-60667 in the July 2026 Critical Patch Update. Administrators should download and apply the PeopleSoft HCM 9.2 patch bundle referenced in the Oracle Security Alert July 2026 and follow Oracle's documented deployment procedure for application server, web server, and database tier updates.
Workarounds
- Place PeopleSoft HCM behind a web application firewall or reverse proxy that enforces authentication before requests reach the application tier.
- Segment the PeopleSoft environment so that only authorized internal clients and integration endpoints can reach TCP listener ports.
- Increase logging verbosity on the HCM Core component and forward events to a centralized monitoring system until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
