This vulnerability affects Oracle PeopleSoft Enterprise CC Common Application Objects version 9.2 and permits an unauthenticated attacker with network access via HTTP to compromise the application objects. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all accessible data within the PeopleSoft Enterprise CC Common Application Objects. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle's July 2026 Critical Patch Update advisory includes multiple security patches and strongly recommends applying patches promptly, although no specific patch for this CVE is explicitly detailed in the advisory content provided.

The vulnerability allows unauthorized attackers to create, delete, or modify critical data within PeopleSoft Enterprise CC Common Application Objects, compromising data confidentiality and integrity. This could lead to significant data breaches or manipulation of critical enterprise data. Availability is not impacted. The CVSS score of 9.1 reflects a critical severity level due to the ease of exploitation and the high impact on confidentiality and integrity.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to address vulnerabilities including this one. Although no specific patch is explicitly linked to CVE-2026-60606 in the advisory content provided, customers should review the advisory and apply all relevant patches for PeopleSoft Enterprise CC Common Application Objects version 9.2 without delay. No vendor advisory states that no action is required or that the issue is already mitigated. Patch status is not yet confirmed explicitly for this CVE; therefore, check the Oracle advisory for the latest remediation guidance.