CVE-2026-60597

{
  "id": "CVE-2026-60597",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T22:17:59.840",
  "lastModified": "2026-10-24T18:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Management).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Cash Management.  While the vulnerability is in PeopleSoft Enterprise FIN Cash Management, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Cash Management accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Cash Management accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto PeopleSoft Enterprise FIN Cash Management de Oracle PeopleSoft (componente: Cash Management). La versión compatible afectada es la 9.2. Vulnerabilidad difícil de explotar que permite a un atacante no autenticado con acceso de red a través de HTTP comprometer PeopleSoft Enterprise FIN Cash Management. Aunque la vulnerabilidad está en PeopleSoft Enterprise FIN Cash Management, los ataques pueden impactar significativamente productos adicionales (cambio de alcance). Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado de creación, eliminación o modificación a datos críticos o a todos los datos accesibles de PeopleSoft Enterprise FIN Cash Management, así como acceso no autorizado a datos críticos o acceso completo a todos los datos accesibles de PeopleSoft Enterprise FIN Cash Management. Puntuación Base CVSS 3.1 de 8.7 (impactos en la Confidencialidad e Integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "PeopleSoft Enterprise FIN Cash Management",
          "versions": [
            {
              "version": "9.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-27T15:35:41.315314Z",
          "id": "CVE-2026-60597",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_fin_cash_management:9.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D833B2A2-014D-49E4-9121-A6568446A217"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}