PeopleSoft PeopleTools CVE-2026-60745

Exploitation requires the attacker to already hold a high-privileged account with interactive logon to the infrastructure/host where Oracle PeopleSoft Enterprise PeopleTools (Application Server - JRE component) executes, on affected versions 8.61 through 8.63. This is local access only (AV:L) - there is no remote or network-facing vector and no user interaction is needed (UI:N). The decisive limiting factor is PR:H: a low-privileged or unauthenticated user cannot exploit this, which substantially narrows the realistic threat to insiders or attackers who have already compromised a privileged account on the server.

This is a low-to-moderate real-world risk despite the CRITICAL-sounding 'complete access to all accessible data' language. The CVSS 3.1 base score is only 4.4 (Medium), driven by the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N: exploitation requires LOCAL access (AV:L) and, critically, an already-high-privileged account (PR:H) with logon to the infrastructure where PeopleTools executes. Impact is confined to confidentiality (C:H) with no integrity or availability effect (I:N/A:N) and no scope change (S:U). No EPSS score, SSVC decision data, KEV listing, or public POC was provided in the input, so exploitation likelihood signals are absent rather than high - there is no public exploit identified at time of analysis. The PR:H precondition is the dominant mitigating factor: an attacker who already holds high privilege on the application server host could already access much of the data this flaw exposes, which is why Oracle scored it Medium rather than Critical. Note a data-quality concern: the input Tag 'Authentication Bypass' directly contradicts the PR:H vector and the description of a 'high privileged attacker with logon' - this is not an authentication bypass and the tag appears mislabeled; verify with the Oracle CPU advisory.

An attacker who has already obtained a high-privileged local account on the server where Oracle PeopleSoft Enterprise PeopleTools runs (e.g., a compromised admin or operator login) leverages the Application Server JRE flaw to read critical data the application processes. Because the attack vector is local and requires high privilege (AV:L/PR:H), this is a post-compromise or insider scenario rather than remote drive-by exploitation. No public exploit identified at time of analysis.