PeopleSoft PeopleTools CVE-2026-60874

Exploitation requires the attacker to possess valid low-privileged PeopleSoft credentials (PR:L) and network HTTP access to the PeopleTools Portal component on an affected version (8.61 or 8.62). The high attack complexity (AC:H) indicates success depends on conditions outside the attacker's direct control - such as specific timing, state, or configuration of the Portal - rather than a reliable single-shot request; no user interaction is needed (UI:N). Limiting factors that reduce real-world risk: authentication is mandatory (not remote-unauthenticated), the attack is hard to reliably reproduce, scope is unchanged (S:U), and impact is capped at partial data read and partial DoS with no integrity or full-availability loss. Only PeopleTools releases 8.61 and 8.62 are stated as affected.

This is a genuinely low-priority vulnerability despite its network attack vector. The CVSS 3.1 base score of 4.2 (Medium) is driven down by three limiting metrics in the vendor vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L): high attack complexity (AC:H), required low-level authentication (PR:L), and only partial confidentiality and availability impact (C:L/A:L) with no integrity impact (I:N). Oracle itself describes it as 'difficult to exploit.' No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no signal of active exploitation or available exploit code - exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent rather than conflicting: a moderate-severity, hard-to-exploit, authenticated flaw with limited impact. The 'Denial Of Service' tag aligns with the A:L (partial DOS) component noted in the description. No CWE was assigned (CWE: N/A), which limits precise classification of the flaw type. Bottom line: a real but minor issue appropriate for routine Oracle Critical Patch Update cycle remediation, not emergency patching.

An attacker who already holds valid low-privileged PeopleSoft credentials sends specially crafted HTTP requests to the Portal component of an internet- or intranet-reachable PeopleTools instance (8.61 or 8.62). After meeting the difficult-to-achieve conditions implied by AC:H, they obtain unauthorized read access to a subset of PeopleTools data and can trigger a partial denial of service. No public exploit code was identified in the provided data.