CVE-2026-60902
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Vulnerability in Oracle's PeopleSoft Enterprise PeopleTools product (component: Tuxedo) affects versions 8.61-8.63. It is difficult to exploit but allows a low-privileged attacker with local access to take over the system. Successful attacks can result in complete takeover of PeopleSoft Enterprise PeopleTools.
Risk Assessment
The risk for the organization is the possibility of a complete takeover of the PeopleSoft system by a low-privileged attacker, potentially leading to compromise of confidentiality, integrity, and availability of data.
Recommendation
It is recommended to urgently apply patches provided by Oracle for versions 8.61-8.63 and to restrict local access to the infrastructure where PeopleSoft runs.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Tuxedo). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).