PeopleSoft PeopleTools CVE-2026-60869

Exploitation requires (1) a valid low-privileged PeopleTools user account (PR:L - this is an authenticated attack, not anonymous), (2) network/HTTP reachability to the PeopleSoft application tier, and (3) interaction with the Application Data Sets component specifically. The High attack complexity (AC:H) indicates additional non-default or attacker-uncontrollable conditions must be met - Oracle explicitly labels it 'difficult to exploit' - which meaningfully limits reliable or repeatable exploitation. Only versions 8.61 through 8.63 of PeopleSoft Enterprise PeopleTools are affected. The authentication requirement and the difficult-to-trigger condition are the primary limiting factors; no user interaction is required (UI:N) once those prerequisites are met.

This is a moderate-priority vulnerability that does NOT rise to emergency status despite affecting a significant enterprise product. The CVSS 3.1 base score of 6.8 (MEDIUM) is driven by high Integrity and Availability impact (I:H/A:H) with no Confidentiality impact (C:N). Two signals materially dampen real-world risk: the attack complexity is High (AC:H), meaning Oracle itself characterizes this as 'difficult to exploit' and likely requiring specific conditions or race-like timing beyond the attacker's direct control, and exploitation requires low-level authentication (PR:L), so the attacker must already hold a valid PeopleTools account. The attack vector is Network via HTTP (AV:N), which broadens reach to anyone who can reach the application tier. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization - this aligns with the typical profile of Oracle Critical Patch Update findings, which are vendor-reported and patched proactively. No signals conflict here; rather, several data points are simply absent (EPSS/KEV/POC), and absence should not be read as confirmation of either safety or danger. Bottom line: prioritize patching in the normal Oracle CPU cycle for internet-exposed or multi-tenant PeopleSoft deployments, but this is not a drop-everything issue given AC:H, PR:L, and no known exploitation.

An attacker who has already obtained a low-privileged PeopleTools user account sends crafted HTTP requests targeting the Application Data Sets component, exploiting a flaw that permits unauthorized modification or deletion of critical data and can also force a complete, repeatable crash (DoS) of PeopleTools. Because attack complexity is High, the attacker must satisfy specific conditions or win non-trivial timing/state requirements, making opportunistic mass exploitation unlikely. No public exploit code is identified at time of analysis.