{"id":"CVE-2026-60500","kind":"vulnerability","aliases":["CVE-2026-60500"],"related":[],"title":"Oracle PeopleSoft PeopleTools Web Server: unauthenticated read of some data","description":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Web Server).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).","summary":"Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 have a flaw in the Web Server component. A remote, unauthenticated attacker can send HTTP requests to gain read access to a subset of data the product can reach.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle","peoplesoft","peopletools","vendor","web-server"],"not_affected_if":["other-peopletools-release"],"how_to_check":"- Confirm the installed PeopleTools release, for example in the PeopleSoft admin pages or with `unknown` if the sources do not say how to read it\n- Check whether the PeopleTools release falls within 8.61-8.63","fix":"- Apply the Oracle Critical Patch Update that covers PeopleSoft PeopleTools 8.61-8.63 (patch details: unknown)\n- Restrict network access to the PeopleSoft web tier until patched","status":"open","published_at":"2026-10-20T22:19:31+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:10:09+00:00","updated_at":"2026-10-25T04:10:09+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:10:09Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that covers PeopleSoft PeopleTools 8.61-8.63 (patch details: unknown)\n- Restrict network access to the PeopleSoft web tier until patched","reach":"internet","title":"Oracle PeopleSoft PeopleTools Web Server: unauthenticated read of some data","impact":"low","summary":"Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 have a flaw in the Web Server component. A remote, unauthenticated attacker can send HTTP requests to gain read access to a subset of data the product can reach.","category":"vendor","nicknames":[],"who_cares":["peoplesoft","peopletools","oracle","web-server"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated read of a subset of PeopleTools-accessible data","analyst_note":"Check the Oracle Critical Patch Update advisory for the patch level and any configuration-dependent exposure; the NVD entry gives no fix or check steps.","how_to_check":"- Confirm the installed PeopleTools release, for example in the PeopleSoft admin pages or with `unknown` if the sources do not say how to read it\n- Check whether the PeopleTools release falls within 8.61-8.63","needs_analyst":true,"not_affected_if":["other-peopletools-release"],"who_is_affected":"Organisations running Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 with the Web Server component reachable over HTTP. The sources do not describe which deployment settings make it exposed, so the exact exposure is unknown. Teams on other PeopleTools releases are not in the listed range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000672,"input_tokens":3531,"output_tokens":638,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-60500':13A,16A '-8.63':81C '/av':145C '3.1':135C,144C '5.8':138C '8.61':29B,80C '8.63':31B 'access':51B,90C,124C,132C 'addit':110C 'affect':78C 'allow':85C 'attack':43B,87C,106C,115C 'base':136C 'c/c':150C 'chang':113C 'compon':39B,71C 'compromis':94C 'confidenti':139C 'cve':11A,14A 'cvss':134C,141C,143C 'data':10A,56B,133C 'easili':82C 'enterpris':26B,65C,96C,104C,130C 'exploit':83C 'flaw':34B 'gain':49B 'http':46B,92C 'impact':109C,140C 'l/i':151C 'l/pr':147C 'may':107C 'n':153C 'n/a':152C 'n/ac':146C 'n/s':149C 'n/ui':148C 'network':89C 'oracl':1A,17B,24B,69C 'peoplesoft':2A,18B,25B,64C,70C,95C,103C,129C 'peopletool':3A,19B,27B,66C,97C,105C,131C 'product':58B,67C,111C 'reach':60B 'read':7A,50B,123C 'remot':41B 'request':47B 'result':120C 'scope':112C 'score':137C 'send':45B 'server':5A,23B,38B,73C 'signific':108C 'subset':54B,127C 'success':114C 'support':74C 'unauthent':6A,42B,86C 'unauthor':122C 'vector':142C 'vendor':20B 'version':28B,75C 'via':91C 'vulner':61C,84C,100C,118C 'web':4A,22B,37B,72C 'web-serv':21B","nicknames":[],"mitigations":[],"who_affected":"Organisations running Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 with the Web Server component reachable over HTTP. The sources do not describe which deployment settings make it exposed, so the exact exposure is unknown. Teams on other PeopleTools releases are not in the listed range.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-60500","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60500","severity":null,"published_at":"2026-10-20T22:19:31+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}