This vulnerability affects Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 in the Panel Processor component. It enables an unauthenticated attacker with network access over HTTP to compromise the system, contingent on user interaction from a third party. The impact includes unauthorized read and modification (update, insert, delete) of some accessible PeopleSoft Enterprise PeopleTools data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) reflects network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality and integrity impacts without availability impact. No known exploits in the wild have been reported. Oracle’s advisory does not explicitly confirm a patch or remediation level for this specific vulnerability but recommends applying Critical Patch Updates promptly.

The vulnerability allows unauthorized actors to gain limited unauthorized read and write access to some PeopleSoft Enterprise PeopleTools data, potentially compromising confidentiality and integrity of that data. It does not impact availability. Exploitation requires user interaction by a person other than the attacker, limiting the attack vector. The medium CVSS score (5.4) reflects these factors.

Oracle’s advisory for the July 2026 Critical Patch Update recommends applying available security patches promptly to address vulnerabilities including this one. However, no explicit patch or remediation level is confirmed for CVE-2026-60152 in the provided advisory content. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Until patches are applied, limit exposure by controlling network access to PeopleSoft Enterprise PeopleTools HTTP interfaces and educating users to avoid interacting with suspicious content that could trigger exploitation.