PeopleSoft PeopleTools CVE-2026-60879

Exploitation requires a valid low-privileged account on the PeopleSoft Enterprise PeopleTools instance (PR:L per CVSS vector) and network access to the system via SQL - implying the Configuration Manager endpoint must be reachable over the network. No user interaction from a victim is required. The attack is constrained by the need for at least a low-privilege authenticated session, meaning fully unauthenticated external exploitation is not supported by the available data. Exploitation is limited to PeopleTools versions 8.61 through 8.63; installations outside this range are not confirmed affected. The scope is unchanged (S:U), meaning exploitation does not inherently pivot to systems outside the PeopleSoft application boundary, though a database-level takeover could enable lateral movement depending on database server configuration.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 8.8, reflecting a network-reachable, low-complexity attack requiring only low-privileged credentials and no user interaction - consistent with a SQL injection in an authenticated but broadly accessible interface. The 'easily exploitable' language in the official Oracle description reinforces the AC:L rating. Full C/I/A impact aligns with the described outcome of 'takeover of PeopleSoft Enterprise PeopleTools,' which implies database-level access enabling data exfiltration, modification, and denial of service. No EPSS score was provided, and no CISA KEV listing exists at time of analysis, so real-world exploitation activity is unconfirmed. However, the low barrier to exploitation (only a valid low-privilege account required) means this should be treated as high priority in environments where PeopleSoft is internet-facing or accessible to a broad internal user population. The 'Information Disclosure' tag from EUVD appears to underrepresent the actual impact given the full-triad CVSS vector - this discrepancy should be noted when triaging.

An attacker with a low-privileged PeopleSoft account - such as a standard end user or a compromised service account - sends a crafted SQL payload to the Configuration Manager component over the network. The injected SQL executes in the context of the PeopleSoft database user, allowing the attacker to read, modify, or delete data and potentially execute database-level commands leading to full application takeover. No public proof-of-concept code has been identified, but the 'easily exploitable' characterization suggests exploitation does not require advanced tooling.