---
id: "CVE-2026-60500"
kind: "vulnerability"
aliases: ["CVE-2026-60500"]
title: "Oracle PeopleSoft PeopleTools Web Server: unauthenticated read of some data"
severity: "medium"
cvss: 5.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["oracle", "peoplesoft", "peopletools", "vendor", "web-server"]
not_affected_if: ["other-peopletools-release"]
published_at: "2026-10-20T22:19:31+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T04:10:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60500", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle PeopleSoft PeopleTools Web Server: unauthenticated read of some data

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 have a flaw in the Web Server component. A remote, unauthenticated attacker can send HTTP requests to gain read access to a subset of data the product can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed PeopleTools release, for example in the PeopleSoft admin pages or with `unknown` if the sources do not say how to read it
- Check whether the PeopleTools release falls within 8.61-8.63

## Fix

- Apply the Oracle Critical Patch Update that covers PeopleSoft PeopleTools 8.61-8.63 (patch details: unknown)
- Restrict network access to the PeopleSoft web tier until patched

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-60500

## From the sources

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Web Server).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_