CVE-2026-60152

Analyzed Analyzed - Analysis Complete

Cross-Site Scripting in Oracle PeopleSoft PeopleTools

Publication date: 2026-07-21

Last updated on: 2026-07-27

Assigner: Oracle

Description

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60152

EUVD

EUVD-2026-46558

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	peoplesoft_enterprise_peopletools	8.61
oracle	peoplesoft_enterprise_peopletools	8.62

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the system. The attack requires interaction from a user other than the attacker. If exploited, it could lead to unauthorized data access or modifications.

Detection Guidance

This vulnerability requires human interaction from a person other than the attacker, making it difficult to detect through automated commands alone. Monitor network traffic for unusual HTTP requests targeting PeopleSoft Enterprise PeopleTools versions 8.61 or 8.62. Check logs for unauthorized data access or modifications in the Panel Processor component.

Impact Analysis

If exploited, this vulnerability could allow attackers to read or modify some data in PeopleSoft Enterprise PeopleTools without authorization. This may lead to data breaches, unauthorized changes, or exposure of sensitive information depending on the system's configuration.

Compliance Impact

This vulnerability could impact compliance by potentially exposing or altering sensitive data, which may violate regulations like GDPR or HIPAA. Unauthorized access or modifications to data could result in legal penalties, fines, or reputational damage for organizations handling regulated information.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. Ensure network access controls restrict HTTP traffic to trusted sources only. Monitor for unusual data access or modification patterns in PeopleTools.

Hi! I’m here to help you understand CVE-2026-60152. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70