CVE-2026-60975: High severity Oracle PeopleSoft Enterprise PeopleTools vulnerability
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
Organizations running supported PeopleSoft Enterprise PeopleTools versions 8.61 or 8.62 are affected. Exploitation requires a low-privileged attacker who already has a logon to the infrastructure where PeopleTools executes, so it is not described as remotely exploitable without infrastructure access.
What access and conditions does an attacker need?
An attacker needs a low-privileged account and logon access to the infrastructure hosting PeopleSoft Enterprise PeopleTools. No user interaction is required, but exploitation is described as difficult and requires high attack complexity.
What could a successful attack allow?
A successful attacker could obtain unauthorized access to critical data or all data accessible through PeopleSoft Enterprise PeopleTools, and could create, delete, or modify that data. The scope change indicates the impact may significantly extend to additional products.