CVE-2026-60879

Analyzed Analyzed - Analysis Complete

SQL Injection in PeopleSoft Enterprise PeopleTools

Publication date: 2026-08-18

Last updated on: 2026-08-21

Assigner: Oracle

Description

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Configuration Manager). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-21

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-60879

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	peoplesoft_enterprise_peopletools	From 8.61 (inc) to 8.63 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools versions 8.61-8.63. It allows a low-privileged attacker with network access to exploit SQL injection and take over the system. The vulnerability has a high CVSS score of 8.8 due to its impact on confidentiality, integrity, and availability.

Detection Guidance

Detection requires checking for vulnerable versions of PeopleSoft Enterprise PeopleTools (8.61-8.63). Review installed versions via PeopleSoft Configuration Manager or application logs. Monitor for unusual SQL queries or unauthorized access attempts targeting PeopleSoft components.

Impact Analysis

An attacker could gain full control of the PeopleSoft Enterprise PeopleTools system, leading to unauthorized access, data theft, or system manipulation. This could disrupt business operations and compromise sensitive data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to unauthorized data access or breaches. Organizations using affected versions may face legal penalties or reputational damage.

Mitigation Strategies

Apply Oracle's official security patches for PeopleSoft Enterprise PeopleTools 8.61-8.63 immediately. Restrict network access to PeopleSoft components via firewalls. Review and enforce least-privilege access for users. Monitor for suspicious activity in SQL queries and application logs.

Hi! I’m here to help you understand CVE-2026-60879. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70