CVE-2026-60742: PeopleSoft PeopleTools Auth Bypass Flaw

CVE-2026-60742 Overview

CVE-2026-60742 is a high-severity vulnerability in Oracle PeopleSoft Enterprise PeopleTools, affecting the PeopleSoft Internet Architecture (PIA) Core Technology component. Supported versions 8.61 through 8.63 are affected. The flaw allows an unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful exploitation results in full takeover of the affected instance, impacting confidentiality, integrity, and availability. The vulnerability is classified under CWE-284: Improper Access Control. Oracle addressed the issue in its August 2026 Critical Security Patch Update.

Critical Impact
Unauthenticated network attackers can achieve complete takeover of PeopleSoft Enterprise PeopleTools deployments, exposing HR, financial, and student data managed by the platform.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools version 8.61
Oracle PeopleSoft Enterprise PeopleTools version 8.62
Oracle PeopleSoft Enterprise PeopleTools version 8.63

Discovery Timeline

2026-08-18 - CVE-2026-60742 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60742

Vulnerability Analysis

The vulnerability resides in the PIA Core Technology component of Oracle PeopleSoft Enterprise PeopleTools. PIA is the web-based front end that brokers HTTP requests between browsers, the application server, and back-end database. An unauthenticated attacker who can send HTTP traffic to the PIA endpoint can exploit the flaw to take control of the PeopleTools instance.

Exploitation is rated high complexity, meaning the attacker must satisfy specific conditions outside their direct control, such as timing, configuration state, or protocol-level preconditions. Despite the complexity, no privileges and no user interaction are required. The impact spans confidentiality, integrity, and availability, indicating that a successful exploit yields administrative-equivalent control.

Root Cause

The flaw is categorized as improper access control [CWE-284]. Oracle has not published low-level technical details, but this CWE class typically indicates that the PIA layer fails to correctly enforce authentication or authorization checks on one or more request paths. A resource, action, or servlet reachable over HTTP accepts requests from principals that should be rejected.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends crafted requests to the PIA web tier of an exposed PeopleSoft deployment. Because authentication is not required, any internet-exposed PIA endpoint is directly reachable. Internal deployments are exploitable by any actor with routing access to the PeopleSoft web tier, including compromised workstations and lateral-movement scenarios.

No public proof-of-concept or exploit code is available at time of publication. The EPSS probability is 0.376%, reflecting current lack of observed exploitation activity. Refer to the Oracle Security Alert for vendor-supplied detail.

Detection Methods for CVE-2026-60742

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to PIA servlet paths such as /psp/, /psc/, and /psigw/ that succeed without a valid session cookie.
Unexpected creation or modification of PeopleTools administrative accounts, roles, or permission lists.
Outbound network connections from PeopleSoft application or web servers to unknown external hosts shortly after anomalous HTTP traffic.

Detection Strategies

Inspect PIA and web server access logs for high volumes of requests to PeopleTools endpoints from a single source lacking authenticated session tokens.
Correlate WebLogic or Tomcat access logs with PeopleSoft PSACCESSLOG and PSAUDIT entries to identify actions performed without a matching authentication event.
Baseline normal PeopleTools administrative activity and alert on deviations such as off-hours role changes or new integration broker nodes.

Monitoring Recommendations

Forward PIA web tier, application server, and database audit logs to a centralized SIEM with retention aligned to incident response requirements.
Enable PeopleSoft signon audit and configuration change auditing to capture credential and permission modifications.
Deploy a web application firewall in front of PIA and monitor for anomalous request patterns targeting core PeopleTools servlets.

How to Mitigate CVE-2026-60742

Immediate Actions Required

Apply the August 2026 Oracle Critical Security Patch Update to all PeopleTools 8.61, 8.62, and 8.63 instances without delay.
Inventory all internet-exposed PIA endpoints and restrict access to trusted networks or VPN users until patching is complete.
Review PeopleTools user, role, and permission list changes made since the vulnerability's publication date for signs of unauthorized modification.
Rotate PeopleSoft administrative credentials and integration broker secrets on any system suspected of exposure.

Patch Information

Oracle has released fixes as part of the August 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert for the exact PeopleTools patch identifiers, prerequisite bundles, and installation guidance. Apply patches in a staged environment first to validate customizations before promoting to production.

Workarounds

Place PIA behind a reverse proxy or web application firewall configured to block unauthenticated access to PeopleTools servlet paths.
Restrict inbound HTTP and HTTPS access to PIA at the network perimeter using firewall rules that allow only known corporate ranges.
Disable or firewall off non-essential PeopleTools services such as the Integration Broker gateway if they are not actively required.

bash

# Example: restrict PIA access to a trusted CIDR at the perimeter (iptables)
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP