CVE-2026-60742: High severity Oracle PeopleSoft Enterprise PeopleTools vulnerability
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate by preventing unauthenticated network access via HTTP to PeopleSoft Enterprise PeopleTools (PIA Core Technology), e.g., restrict HTTP access at the network/firewall/ACL to trusted sources only.
Event History
Frequently Asked Questions
Which deployments are exposed?
Oracle PeopleSoft Enterprise PeopleTools deployments using the PIA Core Technology component on supported versions 8.61 through 8.63 are affected. Exploitation is possible over HTTP from the network.
Does an attacker need an account or user interaction?
No. The vulnerability can be exploited by an unauthenticated attacker and does not require user interaction, although the attack complexity is rated high.
What is the potential impact of successful exploitation?
Successful exploitation can result in takeover of PeopleSoft Enterprise PeopleTools, with high impacts to confidentiality, integrity, and availability.