---
id: "CVE-2026-60839"
kind: "vulnerability"
aliases: ["CVE-2026-60839"]
title: "Oracle PeopleSoft PeopleTools: Query component flaw allows DoS and data changes"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["oracle", "peoplesoft", "peopletools", "vendor"]
not_affected_if: ["no-http-exposure", "unsupported-version"]
published_at: "2026-10-20T22:19:32+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T04:12:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60839", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle PeopleSoft PeopleTools: Query component flaw allows DoS and data changes

A flaw in the Query component of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 can be used by a highly privileged remote attacker over HTTP to crash or hang the application. It can also expose or modify a subset of the data PeopleTools can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-60839

## From the sources

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query).  Supported versions that are affected are 8.61 and  8.62. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data and  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_