CVE-2026-60967: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

CVE-2026-60967 is a vulnerability in the nVision component of Oracle PeopleSoft Enterprise PeopleTools, affecting supported versions 8.61 through 8.63. It allows an unauthenticated remote attacker to compromise the system via HTTP, though successful exploitation requires human interaction from a person other than the attacker. The vulnerability was disclosed on August 18, 2026, as part of Oracle's Critical Security Patch Update (CSPU). It carries a CVSS v3.1 base score of 8.8 (High) (Oracle Advisory).

The vulnerability resides in the nVision component of PeopleSoft Enterprise PeopleTools and is exploitable over HTTP without requiring authentication or elevated privileges (CWE classification not explicitly published by Oracle). The attack vector is network-based with low attack complexity, but requires user interaction — consistent with a social engineering or phishing-assisted attack pattern such as cross-site request forgery or a malicious link scenario. Oracle has not publicly disclosed the precise technical root cause or released a detailed write-up, and no public proof-of-concept code has been identified (Oracle Advisory).

Successful exploitation can result in a complete takeover of the affected PeopleSoft Enterprise PeopleTools instance, with high impact to confidentiality, integrity, and availability. An attacker could gain unauthorized access to all data managed by the system, modify or destroy data, and disrupt service availability. Given PeopleSoft's typical deployment in enterprise HR, finance, and ERP environments, a successful compromise could expose sensitive organizational and employee data and enable lateral movement within the enterprise network (Oracle Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection support is available via Qualys scanner (detection ID 388371) (Oracle Advisory).

Oracle has released a security patch for this vulnerability as part of the August 2026 Critical Security Patch Update, applicable to PeopleSoft Enterprise PeopleTools versions 8.61–8.63. Oracle strongly recommends applying the patch immediately. As a temporary measure prior to patching, network-level controls should be implemented to restrict HTTP access to PeopleSoft systems to authorized users and networks only. User awareness training on social engineering risks is also advisable, as exploitation requires user interaction (Oracle Advisory).