Description
Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Core). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Human Resources accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise HCM Human Resources. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).
Published: 2026-07-21
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated network attacker can exploit a flaw in the Core component of Oracle PeopleSoft Enterprise HCM Human Resources to create, delete, or modify critical database records and to cause frequent application crashes. The vulnerability is an instance of Improper Access Control that bypasses authentication, thereby compromising data integrity and disrupting application availability. The CVE description does not explicitly classify the flaw as Improper Access Control; this classification is inferred from the described behavior.

Affected Systems

Oracle PeopleSoft Enterprise HCM Human Resources version 9.2 is affected. All installations of this version that are reachable via TCP network traffic are vulnerable, regardless of deployment model.

Risk and Exploitability

The CVSS v3.1 score of 7.4 indicates high impact on integrity and availability. The EPSS score of less than 1% reflects a low probability of exploitation at the time of analysis, and the vulnerability is not listed in CISA’s KEV catalog. The description explicitly states that an unauthenticated attacker with TCP network access can exploit the flaw; no credentials are required beyond network connectivity to the affected service.

Generated by OpenCVE AI on August 13, 2026 at 12:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle CPU patch released in July 2026 to address the Improper Access Control (CWE‑284) and Denial‑of‑Service (CWE‑400) vulnerability in PeopleSoft Enterprise HCM Human Resources 9.2.
  • Restrict network access to the PeopleSoft server by enforcing firewall rules that allow traffic only from trusted IP ranges, thereby limiting the opportunities for unauthorized access (CWE‑284).
  • Enable application logging and monitor for abnormal data modification or crash activity to detect exploitation attempts early.

Generated by OpenCVE AI on August 13, 2026 at 12:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 13:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Attacker Can Modify Critical Data and Induce Denial of Service in PeopleSoft Enterprise HCM Human Resources

Thu, 13 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access Allows Data Manipulation and Denial of Service in Oracle PeopleSoft Enterprise HCM Human Resources 9.2
Weaknesses CWE-285

Wed, 05 Aug 2026 02:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access Allows Data Manipulation and Denial of Service in Oracle PeopleSoft Enterprise HCM Human Resources 9.2
Weaknesses CWE-285

Tue, 04 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access in Oracle PeopleSoft Allows Data Tampering and Denial of Service
Weaknesses CWE-284

Thu, 30 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access in Oracle PeopleSoft Allows Data Tampering and Denial of Service
Weaknesses CWE-284

Mon, 27 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access to Modify Data and Cause DoS in Oracle PeopleSoft HCM
Weaknesses CWE-284

Thu, 23 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access to Modify Data and Cause DoS in Oracle PeopleSoft HCM
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Core). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise PeopleSoft Enterprise HCM Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Human Resources accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise HCM Human Resources. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).
First Time appeared Oracle
Oracle peoplesoft Enterprise Hcm Human Resources
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_human_resources:9.2:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Hcm Human Resources
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Oracle Peoplesoft Enterprise Hcm Human Resources
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T19:25:05.965Z

Reserved: 2026-07-08T15:51:55.576Z

Link: CVE-2026-60667

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:18:07.620

Modified: 2026-08-03T12:49:02.690

Link: CVE-2026-60667

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T13:00:04Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-400

    Uncontrolled Resource Consumption