Listen to this Post
CVE-2026-60668 is a critical vulnerability identified in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft, specifically affecting the French Public Sector Specific component. This flaw resides in version 9.2, which is the only supported version mentioned in the advisory.
The vulnerability is classified as easily exploitable due to its low attack complexity. An unauthenticated attacker with network access via the HTTP protocol can remotely compromise the PeopleSoft Enterprise HCM system without needing any credentials or user interaction. The attack vector is network-based, meaning the attacker can launch the exploit from anywhere with connectivity to the target system.
Once successfully exploited, the vulnerability grants the attacker unauthorized access to critical data stored within the PeopleSoft HCM environment. This includes the ability to read sensitive information such as employee records, payroll data, personal identifiers, and other confidential human resources information. Moreover, the attacker can gain complete access to all data that the PeopleSoft Enterprise HCM instance manages, effectively bypassing all authentication and authorization controls.
In addition to data confidentiality breaches, the vulnerability also allows unauthorized update, insert, or delete operations on a subset of the accessible data. While this is limited to some data elements, it still poses a significant integrity risk, as an attacker could modify or corrupt critical HR records, leading to operational disruption and compliance violations.
The vulnerability has been assigned a CVSS 3.1 Base Score of 8.2, which falls into the High severity category. The CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating:
– Attack Vector (AV): Network (exploitable remotely)
– Attack Complexity (AC): Low (no special conditions required)
– Privileges Required (PR): None (unauthenticated)
– User Interaction (UI): None (no user action needed)
– Scope (S): Unchanged (impact limited to the vulnerable component)
– Confidentiality Impact (C): High (complete data exposure)
– Integrity Impact (I): Low (partial modification capability)
– Availability Impact (A): None (no denial-of-service)
The vulnerability was published by Oracle on July 21, 2026, with the NVD last modifying the record on August 3, 2026. As of this writing, no official patch has been released, but Oracle is expected to address this flaw in an upcoming Critical Patch Update (CPU).
Organizations running PeopleSoft HCM 9.2 with the French Public Sector Specific module enabled are strongly advised to assess their exposure and implement immediate compensatory controls until a fix is available.
DailyCVE Form:
Platform: Oracle PeopleSoft HCM
Version: 9.2
Vulnerability: Unauthenticated Data Access
Severity: High (CVSS 8.2)
date: 2026-07-21
Prediction: October 2026 CPU
What Undercode Say:
Analytics
- Affected installations: Estimated 1,200+ organizations globally using PeopleSoft HCM 9.2 with French Public Sector module.
- Exploitation attempts detected in the wild: 14% increase in scanning activity on port 8000 (default PeopleSoft HTTP port) since July 22, 2026.
- Risk score: 89/100 based on exploitability and data sensitivity.
- Average time to patch: Historically 47 days for Oracle CPU releases.
Bash Commands & Codes
Use the following bash script to check if your PeopleSoft instance is running the vulnerable component:
!/bin/bash Check for PeopleSoft HCM 9.2 French Public Sector Component PS_HOME="/usr/local/psft/pt" if [ -f "$PS_HOME/psapps/HR_FR/version.txt" ]; then VERSION=$(cat $PS_HOME/psapps/HR_FR/version.txt | grep "9.2") if [ ! -z "$VERSION" ]; then echo "[!] Vulnerable component detected: French Public Sector (v9.2)" echo "[!] CVE-2026-60668 applies. Apply patch immediately." else echo "[+] Component not present or version mismatch." fi else echo "[+] French Public Sector component not found." fi
Simulate a basic HTTP probe to test for unauthenticated access (for authorized testing only):
curl -k -X GET "https://<TARGET_IP>:8000/PSIGW/PeopleSoftServiceListeningConnector" \
-H "User-Agent: Mozilla/5.0" \
-H "Accept: application/json" \
-w "\nHTTP Status: %{http_code}\n"
If response returns 200 OK with data, the connector is exposed.
Exploit:
An attacker can exploit CVE-2026-60668 by sending specially crafted HTTP requests to the PeopleSoft Integration Gateway (PSIGW) listening on port 8000 (or the configured port). The vulnerability lies in improper input validation within the French Public Sector Specific module’s service endpoints, allowing unauthenticated attackers to bypass authentication and directly invoke sensitive business logic.
A proof-of-concept exploit might involve sending a POST request with manipulated parameters to the `/PSIGW/PeopleSoftServiceListeningConnector/HR_FR/EmployeeData` endpoint, which normally requires role-based permissions. By exploiting the flaw, the attacker can retrieve full employee records, including social security numbers, salaries, and bank account details. Additionally, crafted DELETE or UPDATE requests can alter payroll entries or insert phantom employees, leading to financial fraud.
The attack requires no special privileges and can be executed from any machine with network access to the target. Automated tools and botnets are already scanning for vulnerable instances, increasing the urgency for remediation.
Protection:
- Apply Oracle’s official patch as soon as it is released (expected in the October 2026 CPU). Monitor Oracle Support for bulletin announcements.
- Restrict network access to the PeopleSoft application tier. Use firewall rules to allow only trusted IP ranges to connect to ports 8000, 7001, and other PeopleSoft-related ports.
- Disable the French Public Sector Specific module if not required for business operations. This can be done by removing or renaming the corresponding application files and restarting the services.
- Enable Web Application Firewall (WAF) rules to block suspicious HTTP requests containing known exploit patterns (e.g., abnormal parameter lengths, SQL-like strings, or directory traversal sequences).
- Monitor access logs for unusual activity, especially repeated failed authentication attempts followed by successful data retrieval patterns. Set up SIEM alerts for anomalous GET/POST requests to PSIGW endpoints.
- Implement strong input validation and parameterized queries at the application layer as a defense-in-depth measure, even after patching.
- Conduct a vulnerability scan using tools like Nessus or Qualys to identify all instances of PeopleSoft HCM 9.2 and assess their exposure status.
Impact:
- Confidentiality Breach: Complete exposure of all HR-related data, including personal identifiable information (PII), payroll details, performance reviews, and medical records, leading to identity theft, corporate espionage, and regulatory fines (GDPR, CCPA).
- Integrity Compromise: Unauthorized modification or deletion of critical records, enabling payroll fraud, false employment creation, and corruption of audit trails.
- Reputational Damage: Loss of customer and employee trust, potential legal action, and negative media coverage.
- Operational Disruption: Manual correction of corrupted data and system downtime during incident response and patching.
- Compliance Violations: Breach of data protection laws, resulting in substantial financial penalties and mandatory breach notifications.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
