PeopleSoft PeopleTools CVE-2026-60819

Exploitation targets the Application Server - JRE component of PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63, reachable over the network via SSH; no authentication is required (PR:N) and no user interaction is needed (UI:N). However, the vendor rates this as 'difficult to exploit' (AC:H), indicating success depends on specific conditions outside the attacker's control that are not detailed in the advisory. Impact is limited to partial unauthorized update, insert, or delete access to some PeopleTools-accessible data, with no confidentiality or availability impact, which materially constrains realistic risk despite the unauthenticated network vector.

This is a low-severity, low-priority issue despite being network-reachable and unauthenticated. The CVSS 3.1 base score of 3.7 (vendor-assigned by Oracle) is driven entirely by a low integrity impact (I:L) with no confidentiality or availability consequences, and the vector explicitly marks high attack complexity (AC:H), meaning successful exploitation requires conditions outside the attacker's control. The attack vector is network (AV:N) specifically via SSH, with no privileges required (PR:N) and no user interaction (UI:N), but the combination of AC:H and a bounded 'update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data' places real-world impact at the low end. No EPSS score, CISA KEV entry, or public proof-of-concept is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. There is a signal conflict worth noting: the input Tag 'Authentication Bypass' does not match the description, which describes a difficult-to-exploit integrity flaw rather than an authentication bypass - verify the categorization with Oracle's advisory. Overall this is a genuinely low-risk finding that is appropriately deprioritized relative to other items in the same Oracle CPU, and should be patched as part of routine quarterly maintenance rather than on an emergency basis.

A remote attacker with network access to the PeopleSoft Application Server's SSH-exposed interface attempts to exploit a difficult-to-trigger flaw in the Application Server - JRE component without any credentials. If the specific (attacker-uncontrollable) conditions reflected by AC:H are met, the attacker achieves limited unauthorized update, insert, or delete access to a subset of PeopleTools data. No public exploit code exists for this issue at time of analysis, and the high attack complexity makes reliable exploitation impractical.