Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Configuration Manager). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
That gap stopped being an audit-season embarrassment on August 18. CVE-2026-60879: CVSS 8.8, PeopleTools 8.61-8.63, low-privileged authenticated user to full takeover. Not an admin. Any account holding a role it never needed.
Post summary
The text announces CVE-2026-60879, detailing its CVSS score, affected PeopleTools versions, and the fact that any low‑privileged authenticated user can achieve full takeover.
The one that should change behavior: CVE-2026-60879, CVSS 8.8. A LOW-PRIVILEGED authenticated user to full PeopleTools takeover. Which means any ordinary account holding a role it never needed is a takeover path. Patching closes the instance. Least privilege closes the class.
Post summary
CVE-2026-60879 is a high‑impact vulnerability that allows a low‑privileged authenticated user to compromise PeopleTools, and the text notes that patching will remediate the issue. No PoC, exploit code, or reports of active exploitation are mentioned.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | oracle | peoplesoft_enterprise_peopletools | - | - | - |