This vulnerability affects Oracle PeopleSoft Enterprise HCM Human Resources, specifically version 9.2, and is classified under CWE-284 (Improper Access Control). It permits an unauthenticated attacker with network access over HTTP to compromise the system, resulting in unauthorized access to critical data and limited unauthorized modification capabilities (update, insert, delete) on accessible data. The CVSS 3.1 base score is 8.2, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with low integrity impact and no availability impact. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes many patches, but the specific patch status for this vulnerability is not explicitly stated in the advisory content provided.

Successful exploitation can lead to unauthorized access to critical and sensitive data within PeopleSoft Enterprise HCM Human Resources and unauthorized modification (update, insert, delete) of some accessible data. This compromises confidentiality and integrity of the system data but does not impact system availability. The vulnerability can be exploited remotely without authentication, increasing the risk of compromise.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the provided advisory content does not explicitly confirm the availability of a specific patch for CVE-2026-60668. Customers should review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply relevant patches promptly. Until a patch is confirmed and applied, organizations should consider restricting network access to the affected PeopleSoft Enterprise HCM Human Resources systems to trusted users only and monitor for any unusual activity. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.