---
id: "CVE-2026-60885"
kind: "vulnerability"
aliases: ["CVE-2026-60885"]
title: "Oracle PeopleSoft PeopleTools: Push Notifications flaw allows takeover by privileged attacker"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["on-premises", "oracle", "peoplesoft", "peopletools", "vendor"]
not_affected_if: ["other-peopletools-versions"]
published_at: "2026-10-20T22:19:33+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:43:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60885", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle PeopleSoft PeopleTools: Push Notifications flaw allows takeover by privileged attacker

Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 contain a flaw in the Push Notifications component. A high-privileged attacker with access to the network segment carrying the PeopleTools host's traffic can take over PeopleTools, per the CVSS 3.1 vector (AV:A, PR:H, C:H, I:H, A:H).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PeopleTools version in the PeopleSoft environment (unknown for the exact command; the sources do not say)
- Confirm whether the Push Notifications component is in use (unknown; the sources do not say)

## Fix

- Apply the Oracle Critical Patch Update for PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (exact patch identifiers: unknown; the sources do not say)

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-60885

## From the sources

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications).  Supported versions that are affected are 8.61 and  8.62. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_