CVE-2026-60809 Oracle Corporation CVE debrief

Who should care

Defenders responsible for PeopleSoft Enterprise PeopleTools deployments, particularly those with versions 8.61-8.63, should assess exposure and apply patches. Defenders need to verify affected versions and exposure, and apply patches or updates provided by Oracle. Defenders should also monitor for unauthorized access to PeopleSoft Enterprise PeopleTools data and verify physical security controls for communication segments.

Why it matters

CVE-2026-60809 is a medium-severity vulnerability in PeopleSoft Enterprise PeopleTools that allows an unauthenticated attacker with physical access to compromise the product. Defenders should assess exposure, apply patches, and monitor for unauthorized access.

• Potential unauthorized update, insert or delete access to some PeopleSoft Enterprise PeopleTools accessible data
• Potential unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data
• Requires verification of affected versions and exposure
• Defenders need to assess physical security controls for communication segments

Technical summary

The vulnerability is in the Weblogic component of PeopleSoft Enterprise PeopleTools. CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. The vulnerability allows an unauthenticated attacker with physical access to the communication segment to compromise the product. Successful attacks can result in unauthorized update, insert or delete access to some accessible data and unauthorized read access to a subset of accessible data. Defenders should assess exposure, apply patches, and monitor for unauthorized access.

Defensive priority

Medium priority for defenders to assess exposure and apply patches

Recommended defensive actions

• Assess exposure of PeopleSoft Enterprise PeopleTools versions 8.61-8.63
• Apply patches or updates provided by Oracle
• Monitor for unauthorized access to PeopleSoft Enterprise PeopleTools data
• Verify physical security controls for communication segments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is difficult to exploit and requires access to the physical communication segment. CVSS 3.1 Base Score is 4.2 with Confidentiality and Integrity impacts. The vulnerability affects PeopleSoft Enterprise PeopleTools versions 8.61-8.63. Defenders need to verify affected versions and exposure, and apply patches or updates provided by Oracle.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.