CVE-2026-60975 Overview
CVE-2026-60975 is an access control weakness [CWE-284] in the Security component of Oracle PeopleSoft Enterprise PeopleTools. Supported versions 8.61 and 8.62 are affected. A low-privileged attacker with logon access to the infrastructure hosting PeopleTools can compromise the product. Successful exploitation enables unauthorized creation, deletion, or modification of critical data and full read access to all PeopleTools-accessible data. The vulnerability includes a scope change, meaning attacks can significantly impact additional products beyond PeopleTools itself.
Critical Impact
An authenticated local attacker can gain complete read and write access to PeopleSoft data, with impact extending to adjacent products through scope change.
Affected Products
- Oracle PeopleSoft Enterprise PeopleTools 8.61
- Oracle PeopleSoft Enterprise PeopleTools 8.62
- Oracle PeopleSoft Security component
Discovery Timeline
- 2026-08-18 - CVE-2026-60975 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-60975
Vulnerability Analysis
The flaw resides in the Security component of PeopleSoft Enterprise PeopleTools. It is classified under [CWE-284: Improper Access Control]. The weakness allows a user with existing low-privilege logon rights to bypass intended authorization boundaries within PeopleTools. Once bypassed, the attacker gains read and write control over data managed by the platform.
The vulnerability produces a scope change. Actions initiated within PeopleTools cross a trust boundary and affect resources outside of the vulnerable component. This behavior amplifies the blast radius to other Oracle products or subsystems that trust PeopleTools output. Availability is not impacted, but confidentiality and integrity of managed data are fully exposed.
Exploitation is rated as high complexity by Oracle, indicating that specific conditions must align for a successful attack. However, no user interaction is required once the attacker holds valid logon credentials.
Root Cause
The root cause is improper enforcement of access control checks within the PeopleTools Security component. The component fails to correctly validate whether an authenticated principal is authorized to perform requested operations on protected objects. Missing or inconsistent authorization decisions allow low-privileged accounts to reach functionality reserved for higher-privileged roles.
Attack Vector
The attack vector is local. The attacker must first authenticate to the infrastructure where PeopleTools runs, typically as a low-privilege application user or operating system account with logon rights. From that foothold, the attacker interacts with the vulnerable Security component to escalate their effective data access rights. The high attack complexity indicates timing, configuration, or state-dependent conditions gate the exploit. Refer to the Oracle Security Alert for vendor-published technical context.
Detection Methods for CVE-2026-60975
Indicators of Compromise
- Unexpected read or modification activity against sensitive PeopleTools records performed by low-privilege accounts.
- Authorization decisions in PeopleTools audit logs that grant access without corresponding role assignment changes.
- Cross-product data changes originating from PeopleTools service accounts outside of normal integration flows.
Detection Strategies
- Correlate PeopleTools application audit logs with database-level access logs to identify privilege mismatches between authenticated user and executed operation.
- Baseline normal data access patterns per PeopleTools role and alert on deviations, especially bulk reads or writes from accounts without historical activity of that type.
- Monitor for successful sensitive operations preceded by failed authorization attempts from the same session.
Monitoring Recommendations
- Enable verbose security auditing in PeopleTools and forward logs to a centralized SIEM for retention and correlation.
- Track logon events on hosts running PeopleTools binaries and alert on interactive sessions from service accounts.
- Review privileged and sensitive table access reports on a scheduled cadence until the patch is applied.
How to Mitigate CVE-2026-60975
Immediate Actions Required
- Apply the fixes distributed in the Oracle August 2026 Critical Patch Update for PeopleSoft Enterprise PeopleTools 8.61 and 8.62.
- Inventory all PeopleTools instances and confirm version, patch level, and exposure to interactive logon.
- Restrict logon access to PeopleTools infrastructure to a minimal set of administrators and required service accounts.
Patch Information
Oracle addressed CVE-2026-60975 as part of the August 2026 Critical Patch Update. Administrators should review and apply the vendor-supplied patches referenced in the Oracle Security Alert. Prioritize environments where PeopleTools shares infrastructure with other Oracle products, as the scope change increases downstream risk.
Workarounds
- Enforce least privilege on all PeopleSoft user accounts and remove logon rights from accounts that do not require them.
- Isolate PeopleTools servers from general-purpose user access using network segmentation and jump hosts.
- Increase audit logging on the Security component and require multi-factor authentication for any interactive logon to PeopleTools hosts.
# Configuration example: restrict interactive logon on PeopleTools host (Linux)
# Limit SSH access to a dedicated admin group only
sudo groupadd peopletools-admins
sudo usermod -aG peopletools-admins <admin-user>
echo 'AllowGroups peopletools-admins' | sudo tee -a /etc/ssh/sshd_config
sudo systemctl restart sshd
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
