PeopleSoft PeopleTools CVE-2026-60975

Exploitation requires an attacker to already hold a low-privileged account with the ability to log on locally to the operating system of the server where PeopleSoft Enterprise PeopleTools 8.61 or 8.62 is installed - this is not a remotely exploitable vulnerability from the network. The high attack complexity (AC:H) indicates additional specific conditions must align for exploitation to succeed, such as a race condition, a precise timing window, or a particular configuration state; the exact complexity conditions are not detailed in the available CVE data. Exploitation is scoped to PeopleTools versions 8.61 and 8.62 only. Availability is not impacted (A:N), so disruption of service is not a consequence of this vulnerability. Exploitation is fundamentally bounded by the requirement for local infrastructure access - unauthenticated remote exploitation without a prior foothold on the PeopleTools host is not possible with this vulnerability in isolation.

The CVSS 3.1 base score of 7.5 is driven by scope change and high C/I impact, but AV:L and AC:H substantially reduce realistic exploitability. Exploitation demands prior local logon access to the PeopleTools host infrastructure, confining the attack surface to insiders, compromised service accounts, or attackers who have already established a foothold on the server. No EPSS score was included in the provided intelligence, precluding a probabilistic exploitation forecast. The vulnerability is not listed in CISA KEV and no public exploit code has been identified - both signals suggest this is not currently being actively exploited at scale. Despite these mitigating factors, the Authentication Bypass tag combined with S:C elevates organizational concern: a single low-privileged local account can yield full data access across PeopleTools and downstream integrated systems, which is a severe post-breach amplifier in enterprise Oracle deployments. Organizations with shared jump-host access to PeopleTools servers or permissive developer access to production should treat this as a priority patch cycle item. Well-segmented environments with strict PAM controls face meaningfully lower residual risk.

An insider or an attacker who has previously obtained low-privileged OS-level credentials on a PeopleTools application server - through credential phishing, reuse from another breach, or lateral movement across the internal network - satisfies the high-complexity exploitation conditions within the Security component to bypass authentication controls. The attacker then gains unauthorized read and write access to all PeopleTools-accessible data, including sensitive HR records, financial data, or configuration credentials, and leverages the scope change to pivot into additional Oracle application modules sharing the same PeopleTools runtime. No public proof-of-concept exploit code has been identified at time of analysis.