CVE-2026-60821: PeopleSoft Auth Bypass Vulnerability

CVE-2026-60821 Overview

CVE-2026-60821 is a critical vulnerability in the Oracle PeopleSoft Enterprise PeopleTools product, specifically within the Business Interlink component. Supported versions 8.61 through 8.63 are affected. The flaw allows an unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful exploitation results in full takeover of the affected PeopleTools instance, impacting confidentiality, integrity, and availability. Oracle addressed the issue in its August 2026 security alert.

Critical Impact
Unauthenticated attackers reachable over HTTP can take over PeopleSoft Enterprise PeopleTools instances running affected versions of the Business Interlink component.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.61
Oracle PeopleSoft Enterprise PeopleTools 8.62
Oracle PeopleSoft Enterprise PeopleTools 8.63

Discovery Timeline

2026-08-18 - CVE-2026-60821 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60821

Vulnerability Analysis

The vulnerability resides in the Business Interlink component of Oracle PeopleSoft Enterprise PeopleTools. Business Interlink is the integration layer that allows PeopleSoft applications to invoke external systems and services over HTTP. The flaw is classified under [CWE-284] Improper Access Control, indicating that the component fails to enforce required authorization checks on network-accessible functionality.

An attacker only requires HTTP reachability to the PeopleTools application server. No credentials, no user interaction, and no privileged position are needed. Exploitation yields high-impact effects on confidentiality, integrity, and availability, consistent with full application takeover as described by Oracle.

The Exploit Prediction Scoring System (EPSS) currently reflects a probability of 0.486% with a percentile of 39.99 as of 2026-08-20. Oracle has not disclosed active exploitation, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at publication time.

Root Cause

The root cause is improper access control within the Business Interlink component, mapped to [CWE-284]. Access control decisions on network-exposed functionality are either missing or insufficiently enforced, permitting unauthenticated callers to reach privileged functionality. Oracle has not published detailed root-cause internals beyond the advisory.

Attack Vector

The attack vector is network-based over HTTP. An unauthenticated remote attacker sends crafted HTTP requests to the PeopleTools application server exposing the Business Interlink component. Because attack complexity is low and no user interaction is required, exposure of the PeopleTools HTTP endpoint to untrusted networks presents immediate risk.

No verified public exploit code is available at this time. Refer to the Oracle Security Alert for authoritative technical detail.

Detection Methods for CVE-2026-60821

Indicators of Compromise

Unexpected outbound connections initiated by the PeopleSoft application server to unknown hosts following inbound HTTP traffic to Business Interlink endpoints.
Anomalous HTTP POST requests targeting Business Interlink URLs from external or non-trusted source IP addresses.
Creation or modification of PeopleTools objects, definitions, or scheduled processes without a corresponding administrative session.
New administrative accounts or privilege changes in PeopleTools security tables with no matching change ticket.

Detection Strategies

Inspect web server and application server access logs for unauthenticated requests to Business Interlink handler paths and correlate with process execution on the host.
Baseline normal Business Interlink traffic patterns and alert on volume spikes, unusual user agents, or requests from non-integration source addresses.
Deploy web application firewall rules that log and block malformed or unexpected payloads targeting PeopleTools HTTP endpoints.

Monitoring Recommendations

Forward PeopleSoft web server, application server, and OS audit logs to a centralized SIEM for correlation and retention.
Monitor for child processes spawned by the PeopleTools application server that deviate from known-good process trees.
Track outbound network flows from PeopleTools servers and alert on connections to non-approved destinations.

How to Mitigate CVE-2026-60821

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert to all PeopleTools 8.61, 8.62, and 8.63 instances.
Inventory all internet-facing PeopleSoft deployments and remove direct exposure of PeopleTools HTTP endpoints where operationally feasible.
Review authentication and authorization configuration for Business Interlink integrations and disable unused Business Interlink definitions.

Patch Information

Oracle released a fix as part of the August 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert for the exact patch identifiers applicable to PeopleTools versions 8.61 through 8.63 and follow Oracle's documented patch application procedure for PeopleSoft environments.

Workarounds

Restrict network access to PeopleTools application servers using firewall rules, allowing HTTP only from trusted management and integration networks.
Place a reverse proxy or web application firewall in front of PeopleSoft to filter requests targeting Business Interlink paths until patches are deployed.
Disable Business Interlink definitions that are not required for production integrations to reduce exposed attack surface.

bash

# Example network restriction using iptables to limit HTTP access
# to the PeopleTools application server from trusted subnets only
iptables -A INPUT -p tcp --dport 8000 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP