Description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Web Server). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).
Published: 2026-10-20
Score: 5.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Disclosure
Action: Apply Patch
AI Analysis

Impact

An unauthenticated attacker can use HTTP to read a subset of data from Oracle PeopleSoft Enterprise PeopleTools. The vulnerability exists within the Web Server component and is exploitable with low effort and no authentication. The attack can disclose sensitive information, leading to a confidentiality impact as indicated by the CVSS vector.

Affected Systems

Oracle Corporation PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 are affected.

Risk and Exploitability

The CVSS base score of 5.8 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires only network access via HTTP and no credentials, the exploitability is high. The scope change in the vector suggests that success may allow the attacker to affect other related products.

Generated by OpenCVE AI on October 21, 2026 at 06:00 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle patch for PeopleSoft that addresses CVE-2026-60500
  • Restrict HTTP access to the PeopleSoft Web Server to trusted IP ranges
  • Monitor web server logs for suspicious unauthenticated access attempts

Generated by OpenCVE AI on October 21, 2026 at 06:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Disclosure in Oracle PeopleSoft Enterprise PeopleTools
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Web Server). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).
First Time appeared Oracle
Oracle peoplesoft Enterprise Peopletools
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Peopletools
References
Metrics cvssV3_1

{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N'}

Subscriptions

Oracle Peoplesoft Enterprise Peopletools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T12:04:40.491Z

Reserved: 2026-07-08T15:51:40.541Z

Link: CVE-2026-60500

cve-icon Vulnrichment

Updated: 2026-10-27T12:04:35.263Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:19:31.520

Modified: 2026-10-27T18:03:01.160

Link: CVE-2026-60500

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T18:15:11Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control