PeopleSoft PeopleTools CVE-2026-60876

Exploitation targets the Search Framework component of PeopleSoft Enterprise PeopleTools 8.62 specifically. While no authentication is required of the attacker (PR:N), exploitation is materially limited by two factors: (1) it REQUIRES human interaction from a victim other than the attacker (UI:R) - the attacker must successfully lure a legitimate user into triggering the malicious request/link; and (2) it is explicitly rated difficult to exploit (AC:H), implying additional conditions such as timing, specific application state, or non-trivial preparation must be met. Impact is bounded to Low confidentiality (read access to a subset of data) and Low integrity (limited insert/update/delete), with no availability impact. These limiting factors - mandatory victim interaction and high complexity - keep realistic risk well below what the 'unauthenticated network' label alone might suggest.

This is a genuinely low-priority issue despite being network-reachable. The CVSS 3.1 base score is only 4.2 (Medium), and the vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) shows that although exploitation is unauthenticated over HTTP, it is gated by high attack complexity (AC:H) AND required human interaction from a victim other than the attacker (UI:R), with only Low confidentiality and Low integrity impact and no availability impact. No EPSS score, no CISA KEV listing, and no public exploit (POC) were provided in the input, so there is no public exploit identified at time of analysis. The combination of AC:H + UI:R + limited C:L/I:L impact strongly suggests a client-side flaw (e.g., reflected cross-site scripting or request-forgery-style vector) in the Search Framework rather than a direct server-compromise bug - consistent with scope-unchanged (S:U) and the 'other person's interaction' language. One data-quality concern: the input Tags include 'Authentication Bypass,' which conflicts with the description and CVSS - this is not an auth bypass (the flaw requires luring a victim, not bypassing authentication), so that tag appears mislabeled and should not drive prioritization. Net: a real but low-urgency vulnerability appropriate for routine patching in the next Oracle CPU cycle, not an emergency.

An attacker crafts a malicious HTTP request or link targeting the PeopleSoft Search Framework and lures a legitimate user into interacting with it (e.g., clicking the link while using the application). The triggered flaw lets the attacker read a subset of accessible data and perform limited unauthorized insert/update/delete actions in the victim's context. No public exploit code is available, and the high attack complexity plus required victim interaction make reliable exploitation difficult.