PeopleSoft PeopleTools CVE-2026-60967

Exploitation requires a target running PeopleSoft Enterprise PeopleTools version 8.61, 8.62, or 8.63 with the nVision component enabled and accessible via HTTP. The attacker requires no credentials or prior access to the application (PR:N per official CVSS vector). A mandatory prerequisite is that a human user of the PeopleSoft application interacts with attacker-controlled content - most plausibly an authenticated PeopleSoft session holder who follows a crafted link or visits a malicious page (UI:R). This interaction requirement is the single most important limiting factor: fully automated or unaided remote exploitation is not possible without victim participation. Exploitation risk is substantially elevated for internet-facing PeopleSoft deployments compared to internally-accessible-only instances, and for organizations where PeopleSoft users receive and act on external email communications. The specific nVision configuration required (if any beyond the component being enabled) is not disclosed in available intelligence.

The CVSS 3.1 score of 8.8 is well-supported by the vector: network-accessible with low complexity and no authentication requirement are significant risk amplifiers, partially offset by the mandatory human interaction (UI:R). EPSS data is absent from the provided intelligence, preventing probabilistic exploitation likelihood scoring. No CISA KEV listing is present, and no public exploit code has been identified - both meaningful signals that opportunistic mass exploitation is not currently occurring. The UI:R requirement structurally prevents automated worm-style or scanner-driven exploitation, limiting risk to targeted social-engineering campaigns (e.g., phishing a PeopleSoft user). A notable tension exists between Oracle's 'Information Disclosure' tag and the full C:H/I:H/A:H CVSS rating with 'takeover' language - this discrepancy should be explicitly verified against the Oracle My Oracle Support portal, as it may affect remediation urgency and scope. Organizations with internet-exposed PeopleSoft instances face elevated risk; those behind VPN with no external HTTP access face substantially reduced real-world exposure. Overall, this is a genuine high-severity finding warranting patching within the next CPU cycle, but not an emergency requiring immediate 24-hour response absent evidence of active targeting.

An attacker identifies an organization running PeopleSoft PeopleTools 8.61-8.63 with the nVision component reachable over HTTP and crafts a malicious URL or page targeting the vulnerable nVision endpoint. The attacker delivers this via a phishing email to a PeopleSoft user who is currently authenticated, and when the user clicks the link or visits the page, the exploit triggers - potentially hijacking the user's session or executing malicious actions in their context - ultimately granting the attacker full control over the PeopleSoft instance. No public proof-of-concept exploit has been identified at time of analysis, but the low attack complexity indicates the barrier to exploit development is not high once the specific vulnerable parameter or endpoint is identified.