Description
Vulnerability in the PeopleSoft Enterprise FIN Staffing Front Office product of Oracle PeopleSoft (component: Staffing Front Office). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Staffing Front Office. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Staffing Front Office accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Published: 2026-07-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Oracle PeopleSoft Enterprise FIN Staffing Front Office version 9.2 permits an unauthenticated attacker with network access via HTTP to create, delete, or modify critical data without authentication. This access control weakness (CWE‑284) compromises the integrity of all data exposed by the application and could allow the attacker to alter or erase records that are otherwise protected by the system.

Affected Systems

Oracle PeopleSoft Enterprise FIN Staffing Front Office version 9.2 is affected, specifically the Staffing Front Office component.

Risk and Exploitability

The CVSS base score of 7.5 indicates high severity, primarily impacting integrity. The EPSS score is under 1%, suggesting a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based over HTTP; no authentication or privileged credentials are needed to exercise the flaw, allowing an attacker to modify data with relative ease.

Generated by OpenCVE AI on August 2, 2026 at 21:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch for PeopleSoft Enterprise FIN Staffing Front Office 9.2 or upgrade to a newer, non‑affected release.
  • Restrict network access to the application server or disable external HTTP access to the Staffing Front Office component, limiting exposure only to trusted hosts or over VPN.
  • Enable and review audit logging for data modifications, and monitor logs for unexpected changes or anomalous activity.

Generated by OpenCVE AI on August 2, 2026 at 21:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access Allows Data Modification in Oracle PeopleSoft Enterprise FIN Staffing Front Office

Sat, 01 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP data modification in Oracle PeopleSoft Enterprise FIN Staffing Front Office 9.2
Weaknesses CWE-287

Mon, 27 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 27 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP data modification in Oracle PeopleSoft Enterprise FIN Staffing Front Office 9.2
Weaknesses CWE-284
CWE-287

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise FIN Staffing Front Office product of Oracle PeopleSoft (component: Staffing Front Office). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Staffing Front Office. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Staffing Front Office accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Fin Staffing Front Office
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_fin_staffing_front_office:9.2:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Fin Staffing Front Office
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Fin Staffing Front Office
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-30T13:02:38.662Z

Reserved: 2026-07-08T15:51:40.546Z

Link: CVE-2026-60593

cve-icon Vulnrichment

Updated: 2026-07-27T15:31:23.445Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T21:45:03Z

Weaknesses