This vulnerability affects Oracle PeopleSoft Enterprise HCM Human Resources version 9.2. It is difficult to exploit but allows an unauthenticated attacker with network access via TCP to compromise the application. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data and cause a hang or repeated crashes resulting in complete denial of service. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Customers are urged to apply available patches promptly to mitigate risks.

An attacker can gain unauthorized ability to create, delete, or modify critical data within PeopleSoft Enterprise HCM Human Resources 9.2. Additionally, the attacker can cause the application to hang or crash repeatedly, resulting in a denial of service. There is no confidentiality impact reported. The integrity and availability of the system are significantly affected.

Oracle's July 2026 Critical Patch Update advisory recommends that customers remain on actively supported versions and apply security patches without delay. However, the advisory does not explicitly confirm a patch for CVE-2026-60667. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Until a patch is confirmed and applied, restrict network access to the affected service where possible and monitor for unusual activity related to PeopleSoft Enterprise HCM Human Resources.