What is the CVSS score of CVE-2026-60902?

CVE-2026-60902 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PeopleSoft PeopleTools are affected by CVE-2026-60902?

Oracle PeopleTools versions 8.61-8.63 contain a local privilege escalation vulnerability enabling authenticated users with infrastructure access to achieve complete system compromise.

How to fix or mitigate CVE-2026-60902?

Within 24 hours, conduct a complete inventory of all systems running PeopleTools 8.61-8.63 and immediately restrict infrastructure logon access to essential authorized personnel only; document affected systems and the service accounts currently granted access. Within 7 days, implement privileged access management (PAM) controls with mandatory session recording and approval workflows, enable comprehensive audit logging for infrastructure logons and privilege escalation attempts, and enforce multi-factor authentication for all administrative access to affected systems. Within 30 days, continue monitoring Oracle's security advisory channels for patch availability and plan an urgent upgrade to PeopleTools 8.64 or later once released; maintain compensating controls including network segmentation and real-time alerting as interim protection until patching is available.

PeopleSoft PeopleTools CVE-2026-60902

EUVD-2026-61460 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-88wh-r7w8-2whr

Oracle Authentication Bypass Peoplesoft Enterprise Peopletools

7.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local-only access, low privileges, and high complexity are consistent with a Tuxedo IPC or runtime flaw; full takeover justifies C:H/I:H/A:H with unchanged scope.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 04:36 vuln.today

CVE Published

Aug 18, 2026 - 21:16 nvd

HIGH 7.0

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Tuxedo). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Local privilege escalation in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 enables a low-privileged attacker with infrastructure logon access to achieve full system takeover via the Tuxedo middleware component. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires physical or session-level access to the host and involves high attack complexity, materially limiting opportunistic exploitation despite the complete CIA impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an attacker to have an active local logon session on the infrastructure host where PeopleSoft Enterprise PeopleTools executes - remote unauthenticated exploitation is not possible given AV:L. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 7.0 reflects a genuine but constrained risk profile: the local attack vector (AV:L) requires an attacker to already have logon access to the infrastructure host, and the high attack complexity (AC:H) implies non-trivial exploitation prerequisites such as race conditions, timing dependencies, or specific runtime state. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply Oracle's Critical Security Patch Update for August 2026 (CPUAUG2026), available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, conduct a complete inventory of all systems running PeopleTools 8.61-8.63 and immediately restrict infrastructure logon access to essential authorized personnel only; document affected systems and the service accounts currently granted access. …

Threat intelligence, references, and detailed analysis are available after sign-in.