{"id":"CVE-2026-60885","kind":"vulnerability","aliases":["CVE-2026-60885"],"related":[],"title":"Oracle PeopleSoft PeopleTools: Push Notifications flaw allows takeover by privileged attacker","description":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications).  Supported versions that are affected are 8.61 and  8.62. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 contain a flaw in the Push Notifications component. A high-privileged attacker with access to the network segment carrying the PeopleTools host's traffic can take over PeopleTools, per the CVSS 3.1 vector (AV:A, PR:H, C:H, I:H, A:H).","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["on-premises","oracle","peoplesoft","peopletools","vendor"],"not_affected_if":["other-peopletools-versions"],"how_to_check":"- Check the installed PeopleTools version in the PeopleSoft environment (unknown for the exact command; the sources do not say)\n- Confirm whether the Push Notifications component is in use (unknown; the sources do not say)","fix":"- Apply the Oracle Critical Patch Update for PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (exact patch identifiers: unknown; the sources do not say)","status":"open","published_at":"2026-10-20T22:19:33+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:43:13+00:00","updated_at":"2026-10-25T03:43:13+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:43:13Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (exact patch identifiers: unknown; the sources do not say)","reach":"network","title":"Oracle PeopleSoft PeopleTools: Push Notifications flaw allows takeover by privileged attacker","impact":"high","summary":"Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 contain a flaw in the Push Notifications component. A high-privileged attacker with access to the network segment carrying the PeopleTools host's traffic can take over PeopleTools, per the CVSS 3.1 vector (AV:A, PR:H, C:H, I:H, A:H).","category":"vendor","nicknames":[],"who_cares":["peoplesoft","peopletools","oracle","on-premises"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with high privileges takes over PeopleTools, reads and changes data","analyst_note":"Confirm the patch identifiers and whether Push Notifications is enabled by default at https://nvd.nist.gov/vuln/detail/CVE-2026-60885 and Oracle's Critical Patch Update advisory.","how_to_check":"- Check the installed PeopleTools version in the PeopleSoft environment (unknown for the exact command; the sources do not say)\n- Confirm whether the Push Notifications component is in use (unknown; the sources do not say)","needs_analyst":true,"not_affected_if":["other-peopletools-versions"],"who_is_affected":"Teams running Oracle PeopleSoft Enterprise PeopleTools 8.61 or 8.62. The attack path requires adjacent network access, so exposure depends on who can reach that network segment. Teams on other PeopleTools versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000691,"input_tokens":3516,"output_tokens":679,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-60885':14A,17A '/av':154C '3.1':64B,141C,153C '6.8':144C '8.61':29B,95C '8.62':31B,97C 'a/ac':155C 'access':46B,106C 'affect':93C 'allow':7A,101C 'attach':112C 'attack':11A,44B,104C,128C 'av':66B 'avail':148C 'base':142C 'c':70B 'carri':51B 'communic':110C 'compon':39B,86C 'compromis':123C 'confidenti':145C 'contain':32B 'cve':12A,15A 'cvss':63B,140C,150C,152C 'easili':98C 'enterpris':27B,80C,119C,125C,138C 'execut':121C 'exploit':99C 'flaw':6A,34B 'h':69B,71B,73B,75B,162C 'h/a':161C 'h/i':160C 'h/ui':157C 'hardwar':115C 'high':42B,102C 'high-privileg':41B 'host':54B 'impact':149C 'integr':146C 'l/pr':156C 'n/s':158C 'network':49B 'notif':5A,38B,88C 'on-premis':18B 'oracl':1A,21B,25B,84C 'peoplesoft':2A,22B,26B,79C,85C,118C,124C,137C 'peopletool':3A,23B,28B,53B,60B,81C,120C,126C,139C 'per':61B 'physic':109C 'pr':68B 'premis':20B 'privileg':10A,43B,103C 'product':82C 'push':4A,37B,87C 'result':133C 'score':143C 'segment':50B,111C 'success':127C 'support':89C 'take':58B 'takeov':8A,135C 'traffic':56B 'u/c':159C 'vector':65B,151C 'vendor':24B 'version':90C 'vulner':76C,100C,131C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle PeopleSoft Enterprise PeopleTools 8.61 or 8.62. The attack path requires adjacent network access, so exposure depends on who can reach that network segment. Teams on other PeopleTools versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-60885","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60885","severity":null,"published_at":"2026-10-20T22:19:33+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}