What is the CVSS score of CVE-2026-60152?

CVE-2026-60152 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

PeopleSoft PeopleTools CVE-2026-60152

EUVD-2026-46558 MEDIUM

Improper Authorization (CWE-285)

2026-07-21 oracle

GHSA-vrrc-6vh9-q2j9

Authentication Bypass Oracle Peoplesoft Enterprise Peopletools Oracle Corporation

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-accessible HTTP vector with no privilege required; user interaction mandatory for delivery; limited confidentiality and integrity impact, no availability impact, unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:28 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).

AnalysisAI

Cross-site or client-side injection in Oracle PeopleSoft Enterprise PeopleTools Panel Processor (versions 8.61 and 8.62) enables unauthenticated remote attackers to achieve limited unauthorized data read and write access by luring an authenticated user into interacting with a crafted HTTP request. The attack requires no privileges and no special configuration, but depends on human interaction from a victim - consistent with a reflected attack surface in the Panel Processor UI component. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog. Despite the 'Authentication Bypass' tag, the CVSS vector and impact scope indicate this is a partial, integrity-and-confidentiality-affecting client-side flaw rather than a full authentication bypass.

Technical ContextAI

PeopleSoft Enterprise PeopleTools is Oracle's foundational development and runtime platform for PeopleSoft applications, including HR, finance, and supply chain modules. The Panel Processor is a server-side component responsible for rendering and processing PeopleSoft application pages (panels) delivered over HTTP. The affected CPE is cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:* covering versions 8.61 and 8.62. No CWE has been assigned by the reporter, which limits root-cause classification; however, the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) and the 'Authentication Bypass' tag together suggest an improper neutralization or request-forgery class flaw within the Panel Processor's HTTP handling - potentially allowing an attacker-controlled request to execute in the context of a victim's session.

RemediationAI

Oracle released patches for this vulnerability as part of the Critical Patch Update for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Organizations should apply the July 2026 CPU patches for PeopleSoft Enterprise PeopleTools 8.61 and 8.62 according to Oracle's patch application guidance. An exact patched version number beyond the CPU release designation is not independently confirmed in the available data. As a compensating control pending patching, restricting external network access to PeopleSoft Panel Processor endpoints - particularly ensuring the PeopleSoft web tier is not exposed directly to untrusted networks without a WAF or reverse proxy - reduces the attack surface by eliminating the attacker's ability to deliver crafted HTTP requests to unauthenticated entry points. Note that network restriction does not eliminate the vulnerability if the attacker can reach the system via internal access.