CVE-2026-60745 Oracle Corporation CVE debrief

Who should care

System administrators and security teams responsible for PeopleSoft Enterprise PeopleTools installations, particularly those with versions 8.61-8.63, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-60745 is a medium-severity vulnerability in PeopleSoft Enterprise PeopleTools that allows high-privileged attackers to compromise the system and access critical data. System administrators and security teams should assess exposure, prioritize remediation, and implement compensating controls to minimize the attack surface.

• Potential unauthorized access to critical data requires immediate attention and remediation to prevent data breaches.
• High-privileged attackers with logon access can compromise the system, emphasizing the need for strict access controls.
• Successful attacks can result in complete access to all PeopleSoft Enterprise PeopleTools accessible data, highlighting the importance of monitoring and incident response planning.

Technical summary

The vulnerability in PeopleSoft Enterprise PeopleTools, component Application Server - JRE, allows high-privileged attackers with logon access to compromise the system. Successful attacks can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. The CVSS 3.1 Base Score is 4.4 (Confidentiality impacts). The vulnerability has a local attack vector with low attack complexity, requiring high privileges but no user interaction. The scope is unchanged, with high confidentiality impact but no integrity or availability impact.

Defensive priority

Medium-priority vulnerability remediation is recommended for PeopleSoft Enterprise PeopleTools versions 8.61-8.63, focusing on restricting access to critical systems and monitoring for suspicious activity.

Recommended defensive actions

• Review and apply Oracle's security patches for PeopleSoft Enterprise PeopleTools versions 8.61-8.63.
• Restrict logon access to critical systems to minimize the attack surface.
• Monitor for suspicious activity and implement compensating controls as needed.
• Conduct a thorough review of system configurations and user privileges to ensure that access is limited to necessary personnel.
• Implement additional logging and monitoring to detect potential exploitation attempts.
• Perform regular security audits to identify and address any vulnerabilities in a timely manner.
• Consider implementing a vulnerability management program to stay informed about potential vulnerabilities in PeopleSoft Enterprise PeopleTools.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its CVSS score, and affected versions. Vendor advisory from Oracle is also available. The vulnerability is in PeopleSoft Enterprise PeopleTools versions 8.61-8.63, specifically in the Application Server - JRE component. The CVSS 3.1 Base Score is 4.4, with a vector of (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). The vulnerability allows high-privileged attackers with logon access to compromise PeopleSoft Enterprise PeopleTools, potentially leading to unauthorized

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.