cve-2026-60667

{
  "cve": "CVE-2026-60667",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "generic",
              "value": "9.2"
            }
          }
        ],
        "enrichment": {
          "confidence": 95.0,
          "confidence_source": "inferred",
          "scores": [
            {
              "score": 95.0,
              "source": "inferred"
            },
            {
              "score": 100.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "PeopleSoft Enterprise HCM Human Resources",
          "source": "cna",
          "vendor": "Oracle Corporation"
        },
        "product": "peoplesoft_enterprise_hcm_human_resources",
        "vendor": "oracle"
      }
    ],
    "created": "2026-07-22T11:30:16.727134+00:00",
    "title": "Unauthenticated Network Attacker Can Modify Critical Data and Induce Denial of Service in PeopleSoft Enterprise HCM Human Resources",
    "updated": "2026-08-13T13:00:04.982423+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$peoplesoft_enterprise_hcm_human_resources"
    ]
  },
  "epss": {
    "score": 0.00356
  },
  "mitre": {
    "cpes": [
      "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_human_resources:9.2:*:*:*:*:*:*:*"
    ],
    "created": "2026-07-21T21:36:27.686000+00:00",
    "description": "Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Core).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise PeopleSoft Enterprise HCM Human Resources.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Human Resources accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise HCM Human Resources. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 7.4,
        "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2026/60xxx/CVE-2026-60667.json",
    "references": [
      "https://www.oracle.com/security-alerts/cpujul2026.html"
    ],
    "title": null,
    "updated": "2026-07-24T19:25:05.965000+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$peoplesoft_enterprise_hcm_human_resources"
    ],
    "weaknesses": []
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_human_resources:9.2:*:*:*:*:*:*:*"
    ],
    "created": "2026-07-21T22:18:07.620000+00:00",
    "description": "Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Core).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise PeopleSoft Enterprise HCM Human Resources.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Human Resources accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise HCM Human Resources. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 7.4,
        "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2026/CVE-2026-60667.json",
    "references": [
      "https://www.oracle.com/security-alerts/cpujul2026.html"
    ],
    "title": null,
    "updated": "2026-08-03T12:49:02.690000+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$peoplesoft_enterprise_hcm_human_resources"
    ],
    "weaknesses": [
      "CWE-284",
      "CWE-400"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-07-21T22:00:00+00:00",
        "data": [
          {
            "details": {
              "new": "Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Core).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise PeopleSoft Enterprise HCM Human Resources.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Human Resources accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise HCM Human Resources. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).",
              "old": null
            },
            "type": "description"
          },
          {
            "details": [
              "oracle",
              "oracle$PRODUCT$peoplesoft_enterprise_hcm_human_resources"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_human_resources:9.2:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "oracle",
                "oracle$PRODUCT$peoplesoft_enterprise_hcm_human_resources"
              ],
              "removed": []
            },
            "type": "vendors"
          },
          {
            "details": {
              "added": [
                "https://www.oracle.com/security-alerts/cpujul2026.html"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 7.4,
                  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "e28a5f49-75c6-41be-905c-cc68788f011e"
      },
      {
        "created": "2026-07-23T22:45:00+00:00",
        "data": [
          {
            "details": {
              "new": "Unauthenticated Remote Access to Modify Data and Cause DoS in Oracle PeopleSoft HCM",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-284"
              ],
              "removed": []
            },
            "type": "weaknesses"
          }
        ],
        "id": "690f309a-53ab-45d8-a184-961c54bdc437"
      },
      {
        "created": "2026-07-27T12:30:00+00:00",
        "data": [
          {
            "details": {
              "new": null,
              "old": "Unauthenticated Remote Access to Modify Data and Cause DoS in Oracle PeopleSoft HCM"
            },
            "type": "title"
          },
          {
            "details": {
              "added": [],
              "removed": [
                "CWE-284"
              ]
            },
            "type": "weaknesses"
          }
        ],
        "id": "519722d8-e625-4ef0-86c5-6ab79b117dfd"
      },
      {
        "created": "2026-07-30T13:45:00+00:00",
        "data": [
          {
            "details": {
              "new": "Unauthenticated Network Access in Oracle PeopleSoft Allows Data Tampering and Denial of Service",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-284"
              ],
              "removed": []
            },
            "type": "weaknesses"
          }
        ],
        "id": "cf2461c1-a790-4048-b841-bd1b7d30de7f"
      },
      {
        "created": "2026-08-04T03:30:00+00:00",
        "data": [
          {
            "details": {
              "new": null,
              "old": "Unauthenticated Network Access in Oracle PeopleSoft Allows Data Tampering and Denial of Service"
            },
            "type": "title"
          },
          {
            "details": {
              "added": [],
              "removed": [
                "CWE-284"
              ]
            },
            "type": "weaknesses"
          }
        ],
        "id": "ab56e01c-e0d2-450c-ba48-00db0668a44d"
      },
      {
        "created": "2026-08-05T02:15:00+00:00",
        "data": [
          {
            "details": {
              "new": "Unauthenticated Network Access Allows Data Manipulation and Denial of Service in Oracle PeopleSoft Enterprise HCM Human Resources 9.2",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-285"
              ],
              "removed": []
            },
            "type": "weaknesses"
          }
        ],
        "id": "e226a6ad-e7d3-45c1-b9ef-92b1f73ae61d"
      },
      {
        "created": "2026-08-13T11:45:00+00:00",
        "data": [
          {
            "details": {
              "new": null,
              "old": "Unauthenticated Network Access Allows Data Manipulation and Denial of Service in Oracle PeopleSoft Enterprise HCM Human Resources 9.2"
            },
            "type": "title"
          },
          {
            "details": {
              "added": [],
              "removed": [
                "CWE-285"
              ]
            },
            "type": "weaknesses"
          }
        ],
        "id": "95239948-0517-4800-8fff-c482c3c3fcdf"
      },
      {
        "created": "2026-08-13T13:15:00+00:00",
        "data": [
          {
            "details": {
              "new": "Unauthenticated Network Attacker Can Modify Critical Data and Induce Denial of Service in PeopleSoft Enterprise HCM Human Resources",
              "old": null
            },
            "type": "title"
          }
        ],
        "id": "1ab32472-71bb-4bbf-ad77-565dc9a6a7ca"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_human_resources:9.2:*:*:*:*:*:*:*"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "created": {
      "data": "2026-07-21T21:36:27.686000+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Core).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise PeopleSoft Enterprise HCM Human Resources.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Human Resources accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise HCM Human Resources. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 7.4,
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"
        },
        "provider": "mitre"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.00356
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {},
        "provider": null
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://www.oracle.com/security-alerts/cpujul2026.html"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": "Unauthenticated Network Attacker Can Modify Critical Data and Induce Denial of Service in PeopleSoft Enterprise HCM Human Resources",
      "provider": "enrichment"
    },
    "updated": {
      "data": "2026-08-13T13:00:04.982423+00:00",
      "provider": "enrichment"
    },
    "vendors": {
      "data": [
        "oracle",
        "oracle$PRODUCT$peoplesoft_enterprise_hcm_human_resources"
      ],
      "providers": [
        "mitre",
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-284",
        "CWE-400"
      ],
      "providers": [
        "nvd"
      ]
    }
  }
}