{"id":"CVE-2026-60876","kind":"vulnerability","aliases":["CVE-2026-60876"],"related":[],"title":"Oracle PeopleSoft PeopleTools: Search Framework flaw allows limited data read and change","description":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework).   The supported version that is affected is 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).","summary":"A flaw in the Search Framework of Oracle PeopleSoft PeopleTools 8.62 lets an unauthenticated attacker over HTTP read and modify a subset of accessible data. Exploitation is hard and needs a user other than the attacker to take an action.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-apps","oracle","peoplesoft","peopletools","vendor"],"not_affected_if":["other-peopletools-releases","search-framework-not-exposed"],"how_to_check":"- Confirm the PeopleTools release in use is `8.62` (unknown how to read this from the sources beyond the affected version)\n- Check whether the Search Framework is exposed to HTTP access from untrusted networks","fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-60876 for PeopleSoft PeopleTools `8.62` (exact patch identifier unknown)","status":"open","published_at":"2026-10-20T22:19:32+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:41:36+00:00","updated_at":"2026-10-25T04:41:36+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:41:36Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-60876 for PeopleSoft PeopleTools `8.62` (exact patch identifier unknown)","reach":"network","title":"Oracle PeopleSoft PeopleTools: Search Framework flaw allows limited data read and change","impact":"medium","summary":"A flaw in the Search Framework of Oracle PeopleSoft PeopleTools 8.62 lets an unauthenticated attacker over HTTP read and modify a subset of accessible data. Exploitation is hard and needs a user other than the attacker to take an action.","category":"vendor","nicknames":[],"who_cares":["peoplesoft","peopletools","oracle","enterprise-apps"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads and alters a subset of PeopleTools data","analyst_note":"","how_to_check":"- Confirm the PeopleTools release in use is `8.62` (unknown how to read this from the sources beyond the affected version)\n- Check whether the Search Framework is exposed to HTTP access from untrusted networks","needs_analyst":false,"not_affected_if":["other-peopletools-releases","search-framework-not-exposed"],"who_is_affected":"Organizations running Oracle PeopleSoft Enterprise PeopleTools 8.62 with the Search Framework reachable over HTTP. Sites on other PeopleTools releases, or with the Search Framework not exposed, are less likely to be affected; the sources do not list other affected versions.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000643,"input_tokens":3551,"output_tokens":576,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-60876':15A,18A '/av':166C '3.1':154C,165C '4.2':157C '8.62':36B,86C 'access':49B,96C,129C,136C,143C,151C 'action':65B 'affect':84C 'allow':7A,91C 'app':21B 'attack':40B,61B,93C,105C,115C,117C 'base':155C 'chang':12A 'compon':76C 'compromis':100C 'confidenti':158C 'cve':13A,16A 'cvss':153C,162C,164C 'data':9A,50B,137C,152C 'delet':128C 'difficult':87C 'enterpris':20B,70C,102C,134C,149C 'enterprise-app':19B 'exploit':51B,89C 'flaw':6A,27B 'framework':5A,31B,78C 'h/pr':168C 'hard':53B 'http':42B,98C 'human':107C 'impact':161C 'insert':126C 'integr':160C 'interact':108C 'l/a':173C 'l/i':172C 'let':37B 'limit':8A 'modifi':45B 'n':174C 'n/ac':167C 'n/ui':169C 'need':55B 'network':95C 'oracl':1A,22B,33B,74C 'peoplesoft':2A,23B,34B,69C,75C,101C,133C,148C 'peopletool':3A,24B,35B,71C,103C,135C,150C 'person':111C 'product':72C 'r/s':170C 'read':10A,43B,142C 'requir':106C 'result':122C 'score':156C 'search':4A,30B,77C 'subset':47B,146C 'success':104C,116C 'support':80C 'take':63B 'u/c':171C 'unauthent':39B,92C 'unauthor':124C,141C 'updat':125C 'user':57B 'vector':163C 'vendor':25B 'version':81C 'via':97C 'vulner':66C,90C,120C 'well':139C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle PeopleSoft Enterprise PeopleTools 8.62 with the Search Framework reachable over HTTP. Sites on other PeopleTools releases, or with the Search Framework not exposed, are less likely to be affected; the sources do not list other affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-60876","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60876","severity":null,"published_at":"2026-10-20T22:19:32+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}