CVE-2026-60964 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 10/21/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Open Query). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 1.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within Oracle PeopleSoft Enterprise PeopleTools, specifically affecting the Open Query component in versions 8.61 and 8.62, represents a significant security concern for organizations relying on this enterprise resource planning platform. This flaw is categorized as an unauthorized read access issue that allows attackers to retrieve sensitive data from the underlying database without proper authorization checks being enforced during query execution. The affected components are critical infrastructure elements used by many large enterprises for managing human resources, financials, and supply chain operations, making the potential exposure of proprietary or personal information a high-priority risk.
From a technical perspective, this vulnerability is classified as difficult to exploit due to its requirement for specific conditions that limit the attack surface significantly. The Common Vulnerability Scoring System version 3.1 assigns it a base score of 1.9, indicating low severity primarily because the impact on confidentiality is limited while integrity and availability remain unaffected. The vector string CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N reveals that the attack requires local network access, high complexity in execution, and crucially, high privileges for the attacker prior to exploitation. This means an adversary cannot simply exploit this vulnerability remotely or with minimal credentials; they must first gain a foothold within the infrastructure where PeopleTools executes and possess administrative-level access rights.
The operational impact of successfully exploiting this flaw is restricted to unauthorized read access to a subset of data accessible by the compromised account. While this does not allow for direct system compromise, code execution, or denial of service, it facilitates information disclosure that could lead to further reconnaissance activities within the network. Attackers with high privileges who manage to leverage this vulnerability can extract sensitive business intelligence, employee records, or financial details depending on what data is exposed through the improperly secured query mechanisms in PeopleTools 8.61 and 8.62. This aligns with CWE-209 which describes an information exposure through an error message that reveals implementation-specific details, although in this case it may also relate to CWE-732 improper permission assignment for critical resources if the underlying database permissions are not strictly segregated from application logic errors.
Mitigation strategies must focus on strict access control and patch management given the high privilege requirement for exploitation. Organizations running PeopleTools 8.61 or 8.62 should immediately apply the latest security patches provided by Oracle to close this gap in query processing validation. Additionally, implementing principle of least privilege is essential; administrators and service accounts interacting with PeopleSoft should be granted only the minimum database permissions necessary for their functions rather than broad read access across all tables. Network segmentation can also reduce risk by ensuring that even if an attacker gains high-level local access to the application server, they are isolated from direct interaction with the backend databases unless explicitly authorized through secure channels.
This vulnerability maps to MITRE ATT&CK techniques related to Collection and Exfiltration over alternative protocols or internal network discovery phases where attackers use legitimate tools for malicious purposes. Specifically it relates to T1005 Data from Local System as an attacker would be reading data directly from the local database environment after gaining high-level access. Security teams should monitor for unusual query patterns originating from PeopleTools servers and audit logs for any attempts by privileged accounts to execute complex or unexpected queries against sensitive tables. Regular vulnerability assessments focused on application layer security in enterprise software suites are vital to identifying such logic flaws before they can be leveraged even under constrained attack conditions.