PeopleSoft PeopleTools CVE-2026-60964

Exploitation requires the attacker to already have high-privileged credentials AND interactive logon access to the infrastructure host where PeopleSoft Enterprise PeopleTools executes (AV:L, PR:H), specifically abusing the Open Query component on affected versions 8.61 and 8.62. High attack complexity (AC:H) means success depends on conditions outside the attacker's control, further limiting feasibility. Limiting factors: no remote network vector, no unauthenticated path, no user interaction leveraged against a victim, and impact capped at read access to only a subset of accessible data - making realistic exploitation essentially an insider or post-compromise scenario.

This is a genuinely low-priority issue, and the signals are internally consistent rather than conflicting. The Oracle-assigned CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) scores just 1.9: exploitation requires LOCAL access, HIGH attack complexity, and HIGH privileges, and yields only LOW confidentiality impact with no integrity or availability effect. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit was identified at time of analysis - there is no public exploit identified at time of analysis. The impact is limited to unauthorized read access to a subset of PeopleTools-accessible data by an attacker who already holds high privileges on the host, which materially restricts real-world value. Note a tagging discrepancy: the input Tags include 'Authentication Bypass,' but nothing in the description or CVSS vector supports that - the flaw requires strong pre-existing authentication (PR:H) and does not bypass any authentication control, so that tag appears mislabeled. Overall this is a low-CVSS, low-real-risk issue appropriate for routine patching during the Oracle October 2026 CPU rather than emergency remediation.

An attacker who already holds high-privileged credentials and local logon access to the server running PeopleSoft Enterprise PeopleTools abuses the Open Query component to read a limited subset of otherwise-restricted PeopleTools data. The attack is difficult to pull off (high complexity) and no public exploit code is known, so realistic exploitation would be a deliberate insider or post-compromise action rather than opportunistic.