PeopleSoft PeopleTools CVE-2026-60831

The attacker must have network access to the PeopleSoft Integration Broker component over HTTP (typically TCP 443 or 80 depending on deployment). The AC:H metric confirms that exploitation requires meeting a specific high-complexity condition - the exact nature of this condition is not disclosed in the advisory, but common AC:H patterns include a required race condition, a specific server state or configuration flag, a multi-request protocol interaction, or dependency on a non-default but plausible configuration of the Integration Broker. No authentication is required (PR:N), and no user interaction is needed (UI:N). Exploitation is limited by: (1) the AC:H rating, meaning casual or automated scanning is unlikely to reliably trigger the vulnerability; (2) the requirement that the Integration Broker component be network-reachable - organizations that isolate PSIB behind internal networks or strict firewall rules face significantly reduced exposure; (3) scope is unchanged (S:U), meaning exploitation does not inherently pivot to adjacent systems beyond the PeopleTools instance itself.

The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a genuinely severe network-reachable unauthenticated vulnerability - the full C:H/I:H/A:H triad signals Oracle's determination that successful exploitation results in complete platform compromise. The AC:H rating is the key mitigating factor: it indicates that exploitation is not trivially repeatable or automatable against arbitrary targets, requiring specific conditions such as a race condition, multi-step protocol interaction, or particular server state. No EPSS score is available in the provided data. No CISA KEV listing exists, and no public proof-of-concept has been identified, reducing the near-term automated exploitation risk. However, the 'information disclosure' tag is inconsistent with the C:H/I:H/A:H vector and full-takeover language - this discrepancy may indicate a tagging error, or that the advisory bundles multiple related issues; defenders should not interpret the tag as limiting the impact scope. Real-world priority should be high for any organization with internet-facing Integration Broker endpoints, as unauthenticated access combined with high impact warrants patching regardless of AC:H.

An unauthenticated remote attacker identifies an internet-facing PeopleSoft Integration Broker HTTP endpoint on a system running PeopleTools 8.61-8.63. The attacker sends a specially crafted HTTP request that satisfies the high-complexity exploitation condition - such as a specific message sequence, timing window, or malformed payload - causing the Integration Broker service to execute attacker-controlled logic. Successful exploitation yields full control over the PeopleSoft application server, exposing all HCM, Financials, or other PeopleSoft data and allowing modification or destruction of application data. No public proof-of-concept has been identified, meaning exploitation currently requires independent vulnerability research.