PeopleSoft PeopleTools CVE-2026-60814

Exploitation requires the attacker to already have an interactive logon to the server infrastructure where PeopleSoft Enterprise PeopleTools executes (AV:L) AND to already hold high privileges on that system (PR:H); it is further gated by difficult-to-satisfy preconditions (AC:H, described by Oracle as 'difficult to exploit'). The affected surface is the Business Interlink component in PeopleTools versions 8.61-8.63. Limiting factors that reduce real-world risk: no remote network vector, no unauthenticated path, and impact is capped at partial read, partial update/insert/delete, and partial denial of service - not full compromise. Effectively this is reachable only by an already-privileged local user or an attacker who has previously compromised the host.

This is a genuinely low-priority vulnerability across every available signal, with no conflicts between them. The Oracle-assigned CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) scores just 3.9 (Low) and describes the hardest realistic exploitation profile: the attacker must already have local logon access to the infrastructure hosting PeopleTools (AV:L), must already hold high privileges (PR:H), and must overcome difficult-to-satisfy preconditions (AC:H), yielding only partial confidentiality, integrity, and availability impact (C:L/I:L/A:L). No EPSS score was supplied in the input, so exploitation probability cannot be quantified; however, there is no KEV listing and no public exploit code referenced - exploitation status is therefore 'no public exploit identified at time of analysis.' No SSVC decision data was provided. The combination of local-only access, pre-existing high privileges, and high attack complexity means that an attacker capable of exploiting this already possesses substantial access to the host, which markedly limits the marginal risk. This is a high-CVSS-is-NOT-the-case situation: it is correctly rated Low and should be patched on a routine cycle rather than treated as an emergency. No signals conflict; the main gap is the absence of EPSS/KEV/POC data, whose absence is expected for a freshly disclosed Oracle CPU item and is not itself evidence of risk.

An attacker who already holds a high-privileged account and can log on to the server infrastructure running PeopleSoft Enterprise PeopleTools abuses the Business Interlink component to make unauthorized changes to, and limited reads of, a subset of PeopleTools-accessible data and to degrade the service partially. Because exploitation is rated difficult (AC:H) and requires pre-existing privileged local access (AV:L/PR:H), this is a post-compromise or malicious-insider scenario rather than remote opportunistic attack. No public proof-of-concept exploit is identified at time of analysis.