CVE-2026-60152 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise PeopleTools specifically in the Panel Processor component affecting versions 8.61 and 8.62. The flaw represents a medium-severity security weakness that can be exploited by unauthenticated remote attackers through HTTP network connections without requiring any privileged access or authentication credentials. The vulnerability's exploitability is classified as easily accessible, meaning that an attacker with basic network connectivity to the target system can potentially leverage this weakness. The attack requires human interaction from users who are not the attacker themselves, indicating that social engineering or user deception might be necessary components for successful exploitation.
The technical nature of this vulnerability allows for unauthorized modification of data within the PeopleSoft environment through update, insert, or delete operations on specific accessible data sets. Additionally, attackers can gain unauthorized read access to a subset of the system's data, creating potential exposure of sensitive information. The CVSS 3.1 scoring system assigns a base score of 5.4 which reflects the balance between confidentiality and integrity impacts, with no availability impact assessed for this particular vulnerability. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates network accessibility, low attack complexity, no privilege requirements, user interaction needed, unscoped system impact, and limited confidentiality and integrity implications.
From a cybersecurity perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and potentially CWE-352 (Cross-Site Request Forgery) depending on the specific exploitation mechanism. The requirement for human interaction suggests elements of social engineering or user manipulation tactics that may be leveraged through phishing campaigns or other deceptive methods to achieve successful compromise. Organizations implementing PeopleSoft solutions should consider this vulnerability in their risk assessment frameworks, particularly given the potential for data integrity violations and unauthorized information disclosure.
The operational impact of this vulnerability extends beyond simple data access issues, as it can enable attackers to modify business-critical processes and data within the PeopleSoft environment. This could result in financial losses, compliance violations, and damage to organizational reputation. The fact that this affects versions 8.61 and 8.62 means that organizations running these specific releases require immediate attention and remediation efforts. Security teams should implement network monitoring for suspicious HTTP traffic patterns and consider implementing additional access controls or authentication layers to mitigate potential exploitation attempts.
The vulnerability demonstrates the importance of maintaining current security patches and updates for enterprise applications, particularly those handling sensitive business data. Organizations should evaluate their incident response procedures to ensure readiness for potential exploitation attempts and establish monitoring protocols specifically targeting this type of access control weakness. The CVSS scoring indicates a moderate risk level that requires proactive remediation rather than passive monitoring. Security controls should include network segmentation to limit exposure, enhanced logging and monitoring capabilities, and regular vulnerability assessments to identify similar weaknesses in other system components. This vulnerability serves as a reminder of the critical need for continuous security assessment and timely patch management within enterprise environments.
Organizations should prioritize updating their PeopleSoft installations to versions that address this vulnerability while implementing compensating controls such as web application firewalls, network access controls, and enhanced user authentication mechanisms. The requirement for user interaction suggests that awareness training programs may also be necessary to help personnel recognize potential exploitation attempts. Regular security assessments should include penetration testing focused on authentication bypass vulnerabilities and access control weaknesses that could enable similar types of attacks against enterprise applications.