CVE-2026-60975: 
Oracle Peoplesoft Enterprise Peopletools vulnerability analysis and mitigation

CVE-2026-60975 is a privilege escalation vulnerability in the Security component of Oracle PeopleSoft Enterprise PeopleTools, affecting versions 8.61 and 8.62. Disclosed on August 18, 2026, as part of Oracle's Critical Security Patch Update (CSPU), it allows a low-privileged local attacker to compromise the PeopleTools environment with scope change implications — meaning successful exploitation can impact additional products beyond PeopleTools itself. It carries a CVSS v3.1 base score of 7.5 (High) (Oracle Advisory, NVD).

The vulnerability resides in the Security component of Oracle PeopleSoft Enterprise PeopleTools and requires local logon access to the infrastructure where PeopleTools executes. Exploitation is classified as difficult (high attack complexity), requiring a low-privileged account but no user interaction. The attack vector is local (AV:L), and the changed scope (S:C) indicates that a successful exploit can affect resources beyond the vulnerable component itself. No specific CWE classification has been assigned by NVD at this time, and no public technical write-ups or proof-of-concept code have been identified (Oracle Advisory, NVD).

Successful exploitation allows a low-privileged local attacker to perform unauthorized creation, deletion, or modification of critical data accessible to PeopleSoft Enterprise PeopleTools, as well as unauthorized read access to all sensitive data within the system. The scope change means that other products integrated with or dependent on PeopleTools may also be compromised, potentially enabling lateral movement within the enterprise environment. Availability is not impacted, but the combined high confidentiality and integrity impacts represent a significant risk to organizations relying on PeopleSoft for HR, finance, or ERP operations (Oracle Advisory, NVD).

There is no evidence of public proof-of-concept code or active in-the-wild exploitation of CVE-2026-60975 at this time. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and high attack complexity, which further limits the practical exploitability of this vulnerability (Oracle Advisory).

Oracle has released a security patch for CVE-2026-60975 as part of the August 2026 Critical Security Patch Update (CSPU). Organizations running PeopleSoft Enterprise PeopleTools versions 8.61 or 8.62 should apply the patch immediately. As interim measures, Oracle recommends restricting local logon access to PeopleTools infrastructure to only authorized personnel and monitoring for suspicious data modification or unauthorized access activity. Oracle strongly advises against relying on workarounds as a long-term solution (Oracle Advisory).