CVE-2026-60596

Analyzed Analyzed - Analysis Complete

Privilege Escalation in PeopleSoft FIN eSettlements

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Oracle

Description

Vulnerability in the PeopleSoft Enterprise FIN eSettlements product of Oracle PeopleSoft (component: eSettlements). The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN eSettlements executes to compromise PeopleSoft Enterprise FIN eSettlements. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise FIN eSettlements accessible data. CVSS 3.1 Base Score 2.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60596

EUVD

EUVD-2026-46954

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	peoplesoft_enterprise_fin_esettlements	9.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle PeopleSoft Enterprise FIN eSettlements version 9.2. It allows a highly privileged attacker with local system access to read some restricted data from the application. The impact is limited to confidentiality breaches of accessible data.

Detection Guidance

Detection requires reviewing PeopleSoft Enterprise FIN eSettlements logs and access controls. Check for unauthorized read attempts on sensitive data within the application logs. Verify user privileges and ensure only authorized high-privileged users have logon access to the infrastructure.

Impact Analysis

If you use PeopleSoft Enterprise FIN eSettlements version 9.2, an attacker with high-level system access could potentially read sensitive data stored in the application. This could lead to unauthorized access to financial or personal information.

Compliance Impact

This vulnerability could lead to unauthorized data access, which may violate GDPR, HIPAA, or other privacy regulations. Organizations using this software must assess the risk of non-compliance due to potential data exposure.

Mitigation Strategies

Restrict logon access to the infrastructure hosting PeopleSoft Enterprise FIN eSettlements to only essential personnel. Review and audit user privileges regularly. Apply Oracle's security patches or updates for this component as soon as they become available.

Hi! I’m here to help you understand CVE-2026-60596. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70