{"id":"CVE-2026-60839","kind":"vulnerability","aliases":["CVE-2026-60839"],"related":[],"title":"Oracle PeopleSoft PeopleTools: Query component flaw allows DoS and data changes","description":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query).  Supported versions that are affected are 8.61 and  8.62. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data and  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H).","summary":"A flaw in the Query component of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 can be used by a highly privileged remote attacker over HTTP to crash or hang the application. It can also expose or modify a subset of the data PeopleTools can access.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle","peoplesoft","peopletools","vendor"],"not_affected_if":["no-http-exposure","unsupported-version"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T22:19:32+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:12:15+00:00","updated_at":"2026-10-25T04:12:15+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:12:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle PeopleSoft PeopleTools: Query component flaw allows DoS and data changes","impact":"medium","summary":"A flaw in the Query component of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 can be used by a highly privileged remote attacker over HTTP to crash or hang the application. It can also expose or modify a subset of the data PeopleTools can access.","category":"vendor","nicknames":[],"who_cares":["peoplesoft","oracle","peopletools"],"confidence":0.6,"needs_auth":"yes","worst_case":"Application crash, plus partial unauthorized read and write of PeopleTools data","analyst_note":"Check Oracle's Critical Patch Update advisory for the fixed PeopleTools 8.61 and 8.62 patch levels and any detection steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unsupported-version","no-http-exposure"],"who_is_affected":"Organizations running Oracle PeopleSoft Enterprise PeopleTools 8.61 or 8.62 with HTTP access to the application. The attacker must already hold high privileges, so exposure is limited to environments where such accounts exist or could be compromised.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000601,"input_tokens":3583,"output_tokens":486,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-60839':14A,17A '/av':174C '3.1':161C,173C '5.5':164C '8.61':33B,85C '8.62':35B,87C 'abil':115C 'access':66B,98C,138C,145C,150C,158C 'affect':83C 'allow':7A,92C 'also':55B 'applic':52B 'attack':44B,95C,107C 'avail':168C 'base':162C 'caus':117C 'chang':11A 'complet':124C 'compon':5A,27B,77C 'compromis':102C 'confidenti':165C 'crash':48B,123C 'cve':12A,15A 'cvss':160C,170C,172C 'data':10A,63B,146C,159C 'delet':137C 'difficult':88C 'dos':8A,125C 'enterpris':31B,71C,104C,128C,143C,156C 'exploit':90C 'expos':56B 'flaw':6A,23B 'frequent':121C 'h':182C 'h/pr':176C 'h/ui':177C 'hang':50B,119C 'high':41B,93C 'http':46B,100C 'impact':169C 'insert':135C 'integr':166C 'l/a':181C 'l/i':180C 'modifi':58B 'n/ac':175C 'n/s':178C 'network':97C 'oracl':1A,18B,29B,75C 'peoplesoft':2A,19B,30B,70C,76C,103C,127C,142C,155C 'peopletool':3A,20B,32B,64B,72C,105C,129C,144C,157C 'privileg':42B,94C 'product':73C 'queri':4A,26B,78C 'read':149C 'remot':43B 'repeat':122C 'result':112C 'score':163C 'subset':60B,153C 'success':106C 'support':79C 'u/c':179C 'unauthor':114C,133C,148C 'updat':134C 'use':38B 'vector':171C 'vendor':21B 'version':80C 'via':99C 'vulner':67C,91C,110C 'well':131C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle PeopleSoft Enterprise PeopleTools 8.61 or 8.62 with HTTP access to the application. The attacker must already hold high privileges, so exposure is limited to environments where such accounts exist or could be compromised.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-60839","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60839","severity":null,"published_at":"2026-10-20T22:19:32+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}