CVE-2026-60821 Oracle Corporation CVE debrief

Who should care

Organizations using PeopleSoft Enterprise PeopleTools versions 8.61-8.63, as well as security teams and administrators responsible for patching and vulnerability management, should review and apply Oracle's security patches. They should also implement compensating controls, monitor system logs, and plan vendor-supported updates or mitigations.

Technical summary

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. The vulnerability has a CVSS score of 9.8 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

Critical vulnerability in Oracle PeopleSoft Enterprise PeopleTools, with CVSS score of 9.8, allows unauthenticated attackers to compromise the system via HTTP.

Recommended defensive actions

• Review and apply Oracle's security patches for PeopleSoft Enterprise PeopleTools versions 8.61-8.63
• Implement compensating controls, such as network segmentation and access controls, to limit the attack surface
• Monitor system logs for suspicious activity and implement incident response plans
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability affects PeopleSoft Enterprise PeopleTools versions 8.61-8.63. CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The evidence is limited to the CVE record and NVD details. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources