PeopleSoft PeopleTools CVE-2026-60500

Exploitation requires network reachability to the PeopleSoft Enterprise PeopleTools Web Server component over HTTP on affected versions 8.61 through 8.63. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and no special configuration are needed, so default internet- or intranet-exposed PeopleSoft portals are directly at risk. The principal limiting factors are version (only 8.61-8.63) and exposure scope: impact is confined to unauthorized READ access to a subset of data, with no ability to modify data or affect availability, and the scope change (S:C) means leaked data may extend to additional connected products. Restricting web-server exposure to trusted networks materially reduces realistic risk.

This is a moderate-severity (CVSS 3.1 base 5.8), confidentiality-only information-disclosure flaw. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) is favorable to an attacker on the access dimension - network-reachable over HTTP, low complexity, no privileges, no user interaction - which is why Oracle rates it 'easily exploitable.' However, the impact is deliberately limited: only low confidentiality (C:L, 'unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data') with no integrity or availability impact. The scope change (S:C) elevates the score and signals that leaked data may cross a security boundary into additional products, but it does not grant write or code-execution capability. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no positive signal of active or imminent exploitation; absence of these is not proof of safety but does lower immediate urgency. Net: this is a real but second-tier priority - patch it in a normal Oracle Critical Patch Update cycle rather than as an emergency, while recognizing that unauthenticated network-reachable Oracle PeopleSoft is a historically attractive target. NOTE: the input 'Authentication Bypass' tag conflicts with the actual vulnerability shape - a PR:N confidentiality-only read disclosure is an information-exposure issue, not an authentication bypass; treat the tag as unreliable.

An unauthenticated attacker who can reach the PeopleSoft web server sends crafted HTTP requests to the vulnerable Web Server component and retrieves a subset of PeopleTools-accessible data they should not be able to read. No credentials, user interaction, or special timing is required, and because of the scope change the disclosed data may expose information belonging to additional connected products. No public exploit identified at time of analysis.