PeopleSoft PeopleTools CVE-2026-60885

Exploitation requires THREE concrete preconditions, all drawn from the CVSS vector and description: (1) the attacker must hold HIGH privileges on/against the target (PR:H) - this is not an unauthenticated or low-privilege flaw; (2) the attacker must have access to the physical/adjacent communication segment attached to the hardware running PeopleTools (AV:A) - remote Internet-only access is insufficient; and (3) the target must run the affected PeopleTools versions 8.61 or 8.62 with the Push Notifications component in use. No end-user interaction is needed (UI:N). The limiting factors - adjacent-network positioning plus pre-existing high privilege - are what keep real-world risk well below the 'takeover' impact severity, and segment isolation of PeopleTools hosts materially reduces exposure.

This is a moderate-priority issue whose raw CVSS 3.1 base score of 6.8 (MEDIUM) is driven down by two significant barriers encoded in the vector itself: AV:A and PR:H. AV:A means the attacker must sit on the same physical/logical communication segment as the hardware running PeopleTools - not routable Internet access - and the description reinforces this ('access to the physical communication segment attached to the hardware'). PR:H means the attacker must already hold high privileges on the target. These two factors sharply limit the realistic attacker population, so despite C:H/I:H/A:H (full takeover) impact, this is not a drive-by remote threat. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so there is no evidence of active or probable near-term exploitation. Note a tension worth flagging: the vendor text calls it 'Easily exploitable' (consistent with AC:L) yet simultaneously requires both adjacent-network position AND high privileges - 'easily exploitable' here refers to low attack complexity ONCE those preconditions are met, not to low overall attacker effort. Also note the input Tags label this 'Information Disclosure', which understates the actual impact: the CVSS vector and description both indicate full confidentiality, integrity, and availability compromise (takeover), not mere disclosure. Overall: a real but gated vulnerability - patch in normal cycle, prioritize where PeopleTools hosts share segments with less-trusted or privileged-user networks.

An attacker who already holds high privileges and sits on the same local/adjacent network segment as a PeopleSoft PeopleTools 8.61 or 8.62 host targets the Push Notifications component over that segment. By sending crafted traffic across the adjacent communication path, they exploit the flaw to achieve full compromise (takeover) of the PeopleTools instance. No public exploit code was identified at the time of analysis, so any current exploitation would require custom tooling.