CVE-2026-60967: Oracle PeopleSoft Auth Bypass Vulnerability

CVE-2026-60967 Overview

CVE-2026-60967 is a vulnerability in the nVision component of Oracle PeopleSoft Enterprise PeopleTools. Affected versions span 8.61 through 8.63. An unauthenticated attacker with network access via HTTP can compromise PeopleSoft Enterprise PeopleTools when a user other than the attacker performs a required interaction. Successful exploitation results in full takeover of PeopleSoft Enterprise PeopleTools, with high impact to confidentiality, integrity, and availability. Oracle published details in the August 2026 Critical Security Patch Update. The weakness is categorized under [CWE-284] Improper Access Control.

Critical Impact

Successful exploitation leads to complete takeover of PeopleSoft Enterprise PeopleTools, exposing HR, finance, and identity data managed by the platform.

Affected Products

• Oracle PeopleSoft Enterprise PeopleTools 8.61
• Oracle PeopleSoft Enterprise PeopleTools 8.62
• Oracle PeopleSoft Enterprise PeopleTools 8.63 (component: nVision)

Discovery Timeline

• 2026-08-18 - CVE-2026-60967 published to NVD
• 2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60967

Vulnerability Analysis

The vulnerability resides in nVision, the PeopleSoft reporting component that generates Microsoft Excel-based reports from PeopleSoft data. An attacker sends a crafted request over HTTP to trigger the flaw. Exploitation requires human interaction from a user other than the attacker, indicating a user-assisted attack pattern such as clicking a malicious link or opening an attacker-supplied report artifact. Once triggered, the flaw yields takeover of PeopleSoft Enterprise PeopleTools with high confidentiality, integrity, and availability impact. No authentication is required to initiate the attack, which broadens the pool of potential attackers to anyone with network reachability to the PeopleSoft front end.

Root Cause

Oracle categorizes this issue under [CWE-284] Improper Access Control. The nVision component fails to enforce sufficient access control checks on a network-reachable code path. This allows an unauthenticated request to reach functionality that should be gated behind authentication and authorization, and to leverage a privileged user's session or actions once interaction occurs.

Attack Vector

The attack vector is network-based over HTTP. The attacker crafts a request or resource targeting nVision, then induces an authenticated PeopleSoft user to interact with it. The interaction bridges the attacker's unauthenticated request into a privileged execution context, resulting in compromise of the PeopleTools instance. See the Oracle Security Alert for vendor-supplied technical details.

Detection Methods for CVE-2026-60967

Indicators of Compromise

• Unexpected HTTP requests to nVision endpoints originating from untrusted networks or referrers.
• Creation or modification of nVision report layouts, macros, or scheduled jobs outside normal change windows.
• New or modified PeopleTools administrative accounts, roles, or permission lists following user interaction with an external link.

Detection Strategies

• Inspect PeopleSoft web server access logs for anomalous requests targeting nVision URIs, especially from unauthenticated sessions.
• Correlate PeopleTools audit trails with web tier logs to identify privileged actions initiated shortly after external user interaction.
• Alert on outbound connections from PeopleSoft application servers to unfamiliar hosts, which may indicate post-exploitation activity.

Monitoring Recommendations

• Enable verbose logging on the PeopleSoft web tier and forward logs to a centralized analytics platform for correlation.
• Baseline normal nVision request patterns and alert on deviations in volume, source, or parameters.
• Monitor privileged PeopleTools accounts for unusual role assignments, definition changes, or after-hours activity.

How to Mitigate CVE-2026-60967

Immediate Actions Required

• Apply the Oracle August 2026 Critical Patch Update to PeopleTools versions 8.61, 8.62, and 8.63 as documented in the Oracle Security Alert.
• Restrict network exposure of PeopleSoft web tiers so nVision endpoints are not reachable from untrusted networks.
• Review PeopleTools administrative accounts and recent nVision configuration changes for signs of tampering.

Patch Information

Oracle addressed CVE-2026-60967 in the August 2026 Critical Security Patch Update. Customers should follow the vendor guidance in the Oracle Security Alert and apply the patch to all affected PeopleTools instances, including non-production environments used for testing and reporting.

Workarounds

• Place the PeopleSoft web tier behind a web application firewall with rules that block anomalous requests to nVision paths.
• Enforce user awareness measures to reduce the likelihood that PeopleTools users interact with attacker-supplied links or documents.
• Require multi-factor authentication and short session lifetimes for PeopleTools users to reduce the value of hijacked interactions.

# Example: restrict nVision paths at the reverse proxy until the patch is applied
# nginx snippet - adjust paths to match your PeopleSoft deployment
location ~* /psc/.*/nvision/ {
    allow 10.0.0.0/8;      # internal corporate range
    deny  all;             # block all other sources
    proxy_pass http://peoplesoft_backend;
}