CVE-2026-60600

Analyzed Analyzed - Analysis Complete

Privilege Escalation in PeopleSoft Enterprise FIN Project Costing

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Oracle

Description

Vulnerability in the PeopleSoft Enterprise FIN Project Costing product of Oracle PeopleSoft (component: Projects). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Project Costing executes to compromise PeopleSoft Enterprise FIN Project Costing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Project Costing. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60600

EUVD

EUVD-2026-46958

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	peoplesoft_enterprise_fin_project_costing	9.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle PeopleSoft Enterprise FIN Project Costing version 9.2. It allows an unauthenticated attacker with access to the system infrastructure to potentially take over the application. The attack requires some interaction from another user but does not need the attacker to be authenticated.

Detection Guidance

Detection requires checking for Oracle PeopleSoft Enterprise FIN Project Costing version 9.2 and verifying if unauthorized access or unusual activity is present. Review logs for suspicious logins or privilege changes. No specific commands are provided in the available context.

Impact Analysis

If exploited, this vulnerability could allow an attacker to fully take over the PeopleSoft Enterprise FIN Project Costing system. This could lead to unauthorized access to sensitive financial project data, manipulation of project costs, or disruption of financial operations.

Compliance Impact

The vulnerability allows unauthorized takeover of PeopleSoft Enterprise FIN Project Costing, which could lead to unauthorized access, modification, or deletion of sensitive financial and project data. This may impact compliance with GDPR (data protection), HIPAA (health information), and other regulations by compromising confidentiality, integrity, and availability of regulated data.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update for PeopleSoft Enterprise FIN Project Costing 9.2 to address the vulnerability. Ensure proper access controls are in place to restrict unauthorized logons to the infrastructure hosting the component.

Hi! I’m here to help you understand CVE-2026-60600. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70