CVE-2026-60975 in PeopleSoft Enterprise PeopleTools
Summary
by MITRE • 08/19/2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Security component of Oracle PeopleSoft Enterprise PeopleTools, specifically affecting versions 8.61 and 8.62. This flaw represents a significant security risk due to its potential for scope change, meaning that while the technical defect is localized to the PeopleTools infrastructure, successful exploitation can lead to compromises in additional products running on or connected to the same environment. The vulnerability allows an attacker with low privileges who has established logon access to the underlying infrastructure where PeopleSoft Enterprise PeopleTools executes to gain unauthorized control over critical data and system functions. This scenario highlights a common challenge in enterprise application environments where lateral movement from lower-privileged accounts can escalate into full system compromise if proper isolation and least privilege principles are not strictly enforced across all integrated components.
From a technical perspective, the vulnerability is characterized by its difficulty of exploitation, requiring high complexity conditions to trigger successfully. Despite this barrier, the impact profile is severe, as indicated by a CVSS 3.1 Base Score of 7.5. The attack vector involves local access with low privileges and no user interaction required once initial foothold is gained. The core issue lies in insufficient security checks or improper handling of authentication tokens within the Security component, allowing an authenticated but unprivileged user to manipulate internal processes. This flaw aligns closely with CWE-269 Improper Privilege Management, as it involves a low-privilege actor performing actions that should be restricted to higher-level administrators. Furthermore, the ability to modify or delete critical data points toward CWE-732 Incorrect Permission Assignment for Critical Resource, indicating that access control lists or role-based permissions are not correctly validating the scope of operations permitted by specific user roles.
The operational impact of this vulnerability is substantial, encompassing both confidentiality and integrity breaches while leaving availability largely intact according to the provided CVSS vector. Successful exploitation enables an attacker to create, delete, or modify critical data within PeopleSoft Enterprise PeopleTools. This capability can lead to unauthorized access to sensitive information stored in the database, potentially exposing proprietary business logic, employee records, financial data, or other confidential assets managed by the application suite. The integrity impact is equally concerning, as attackers could alter configuration settings, tamper with transactional data, or inject malicious code into system processes. Such actions can disrupt normal business operations, lead to regulatory non-compliance due to data breaches, and cause long-term reputational damage if exploited in a production environment.
The CVSS vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) provides further insight into the risk profile. The Local attack vector suggests that physical or network proximity to the server is required, which limits remote exploitation but does not eliminate threat from insider attacks or compromised low-level service accounts. High complexity indicates that specific environmental conditions must be met, such as timing windows or particular state configurations, making automated widespread attacks difficult. However, the presence of Low privileges requirement and No user interaction lowers the barrier for initial access if an attacker has already gained a foothold through other means like phishing or weak credential management. The Scope Change from C to U is critical here; it signifies that the vulnerability affects resources beyond the vulnerable component itself, expanding the blast radius significantly. This behavior mirrors ATT&CK techniques related to Privilege Escalation and Defense Evasion, where attackers leverage misconfigurations in application frameworks to move laterally or persist within a network segment.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary action is to apply the latest security patches provided by Oracle for PeopleTools versions 8.61 and 8.62 immediately upon availability. Organizations should verify their inventory of affected systems and prioritize patching based on exposure levels, even if direct remote access is not present. In addition to patching, implementing strict network segmentation can limit lateral movement opportunities. If an attacker gains low-level access, firewalls and micro-segmentation policies should prevent them from reaching the PeopleTools infrastructure or associated databases without explicit authorization. Role-based access control (RBAC) reviews are also essential; administrators must ensure that no user accounts possess more privileges than necessary for their job functions. Regular audits of account permissions can help identify dormant or overly privileged accounts that could be leveraged to exploit this vulnerability.
Furthermore, enhancing monitoring and detection capabilities is crucial for identifying potential exploitation attempts in real-time. Security Information and Event Management (SIEM) systems should be configured to alert on unusual activities such as unexpected database modifications, privilege changes, or access patterns inconsistent with normal user behavior. Since the vulnerability allows unauthorized data modification, integrity checking mechanisms like file hashing or database transaction logs can help detect tampering after an incident occurs. Organizations should also consider adopting a zero-trust architecture model where every request is verified regardless of origin, reducing reliance on perimeter defenses and internal trust assumptions. By combining timely patching with robust access controls, network segmentation, and continuous monitoring, enterprises can significantly reduce the risk posed by this vulnerability in their PeopleSoft environments.