PeopleSoft PeopleTools CVE-2026-60902

Exploitation requires an attacker to have an active local logon session on the infrastructure host where PeopleSoft Enterprise PeopleTools executes - remote unauthenticated exploitation is not possible given AV:L. The attacker must hold low-privileged credentials (PR:L), meaning a standard non-administrative OS or application account suffices. Exploitation is further constrained by high attack complexity (AC:H), indicating that success depends on meeting specific preconditions not fully described in available data - likely involving Tuxedo runtime state, timing, or process interaction. Limiting factors include: no remote exploitation path, requirement for an authenticated local session, and non-trivial complexity conditions that prevent reliable automated or scripted exploitation. The vulnerability does not appear to require user interaction or a non-default configuration of PeopleTools beyond the standard Tuxedo deployment.

The CVSS 3.1 base score of 7.0 reflects a genuine but constrained risk profile: the local attack vector (AV:L) requires an attacker to already have logon access to the infrastructure host, and the high attack complexity (AC:H) implies non-trivial exploitation prerequisites such as race conditions, timing dependencies, or specific runtime state. The low privilege requirement (PR:L) means a standard application user account suffices if those complexity conditions are met. Despite the full takeover outcome (C:H/I:H/A:H), this is not a remotely exploitable mass-exploitation scenario - even a mid-sized municipal IT team in zabrze should treat this as urgent patching work rather than emergency incident response, provided remote access to the PeopleSoft host is properly segmented. No EPSS score was provided in the input data, so exploitation probability cannot be quantified independently. The vulnerability is not listed in CISA KEV, and no public POC has been identified, further reducing immediate exploitation likelihood. The absence of a CWE designation limits confidence in root cause and therefore in the effectiveness of generic compensating controls.

An attacker with a low-privileged local account on the PeopleSoft infrastructure host - such as a database service account, a shared application user, or a compromised internal workstation with host access - identifies and satisfies the high-complexity conditions required to trigger the Tuxedo component flaw, such as a timing window or specific IPC state. Upon successful exploitation, the attacker gains control of the PeopleTools runtime process, potentially exposing sensitive HR or ERP data and enabling persistent access. No public POC is known, meaning exploitation currently requires bespoke capability.