CVE-2026-60856
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Vulnerability in PeopleSoft Enterprise PeopleTools (component: Install and Packaging) affects versions 8.61-8.63. It is difficult to exploit by an unauthenticated attacker remotely via HTTP. Successful attacks can result in unauthorized creation, deletion, or modification of data and unauthorized access to critical data.
Risk Assessment
The risk for the organization is the possibility of unauthorized modification and access to critical data, potentially leading to confidentiality and integrity breaches.
Recommendation
It is recommended to apply Oracle patches and to secure HTTP interfaces, e.g., by restricting access to trusted networks.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Install and Packaging). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).