CVE-2026-60902: PeopleSoft PeopleTools Privilege Escalation

CVE-2026-60902 Overview

CVE-2026-60902 is a high-severity vulnerability in the Oracle PeopleSoft Enterprise PeopleTools product, specifically in the Tuxedo component. Supported versions 8.61 through 8.63 are affected. The flaw allows a low-privileged attacker with local logon access to the infrastructure running PeopleSoft Enterprise PeopleTools to compromise the product. Successful exploitation results in complete takeover of PeopleSoft Enterprise PeopleTools, impacting confidentiality, integrity, and availability. The weakness is classified as [CWE-284] Improper Access Control. Oracle published the fix as part of the Oracle Security Alert CSPUAUG2026.

Critical Impact
Successful exploitation grants full takeover of PeopleSoft Enterprise PeopleTools, exposing sensitive HR, financial, and ERP data to unauthorized access, modification, and disruption.

Affected Products

Oracle PeopleSoft Enterprise PeopleTools 8.61
Oracle PeopleSoft Enterprise PeopleTools 8.62
Oracle PeopleSoft Enterprise PeopleTools 8.63

Discovery Timeline

2026-08-18 - CVE-2026-60902 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60902

Vulnerability Analysis

The vulnerability resides in the Tuxedo component of Oracle PeopleSoft Enterprise PeopleTools. Tuxedo functions as the transaction processing middleware that brokers communication between PeopleSoft application servers and backend services. An improper access control flaw in this component permits a locally authenticated, low-privileged user to escalate to full control of the PeopleTools environment.

Exploitation requires the attacker to already possess valid logon credentials on the infrastructure where PeopleSoft executes. The attack complexity is high, meaning the attacker must satisfy specific runtime or configuration conditions to reliably trigger the flaw. When exploited, the attacker achieves complete compromise of confidentiality, integrity, and availability of the PeopleTools instance.

Root Cause

The root cause is classified under [CWE-284] Improper Access Control within the Tuxedo middleware layer. Access control checks fail to correctly restrict actions that should be limited to privileged administrative roles, allowing a lower-privileged local user to invoke or influence sensitive Tuxedo operations tied to PeopleTools management.

Attack Vector

The attack vector is local. The adversary requires an authenticated session on the host or connected infrastructure where PeopleTools runs. No user interaction is required beyond the attacker's own actions. Because Tuxedo mediates transactional operations across PeopleSoft, abuse of the exposed interface enables the attacker to pivot from limited local access to full application-tier takeover. Refer to the Oracle Security Alert CSPUAUG2026 for vendor-provided technical context.

Detection Methods for CVE-2026-60902

Indicators of Compromise

Unexpected process creation or service restarts originating from Tuxedo binaries under the PeopleTools installation directory.
Anomalous logons by low-privileged accounts to PeopleSoft application server hosts followed by privileged operations.
Unusual modifications to PeopleTools configuration files, domain configuration, or Tuxedo TUXCONFIG artifacts.

Detection Strategies

Monitor local authentication events on PeopleSoft infrastructure hosts and correlate them with subsequent Tuxedo administrative actions.
Baseline expected Tuxedo administrative activity and alert on deviations, such as off-hours domain reconfigurations or new service registrations.
Deploy file integrity monitoring against PeopleTools binaries, configuration directories, and Tuxedo runtime files.

Monitoring Recommendations

Forward PeopleSoft, Tuxedo, and host OS logs to a centralized SIEM for correlation across authentication, process, and file-system events.
Track privilege changes and role assignments on PeopleTools accounts and flag privilege drift from established baselines.
Alert on lateral movement patterns targeting PeopleSoft hosts from workstations that do not normally access ERP infrastructure.

How to Mitigate CVE-2026-60902

Immediate Actions Required

Apply the security update referenced in the Oracle Security Alert CSPUAUG2026 to all PeopleTools 8.61, 8.62, and 8.63 deployments.
Inventory all PeopleSoft hosts and confirm patch status across production, disaster recovery, and non-production environments.
Audit local accounts on PeopleSoft infrastructure and remove or disable unnecessary logon access.

Patch Information

Oracle addressed CVE-2026-60902 in the August 2026 Security Alert (CSPUAUG2026). Administrators should download and deploy the patch bundle for PeopleTools versions 8.61 through 8.63 as directed in the advisory. Verify successful patch application through Oracle's opatch or PeopleTools patch validation utilities.

Workarounds

Restrict local logon rights on PeopleSoft servers to a minimal set of administrative accounts pending patch deployment.
Segment PeopleSoft infrastructure on isolated network zones and enforce jump-host access with multi-factor authentication.
Enable enhanced auditing on Tuxedo administrative interfaces and review logs daily until the patch is fully rolled out.

bash

# Configuration example: restrict local logon on Linux PeopleSoft hosts
# Limit interactive access to the psadm group only
echo "-:ALL EXCEPT psadm root:LOCAL" | sudo tee -a /etc/security/access.conf

# Verify current Tuxedo domain access permissions
ls -l $TUXDIR/udataobj/TUXCONFIG
chmod 600 $TUXDIR/udataobj/TUXCONFIG