CVE-2026-60742: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. in Oracle Corporation PeopleSoft Enterprise PeopleTools

This advisory covers multiple security vulnerabilities fixed in Oracle PeopleSoft Enterprise PeopleTools, affecting modules such as Integration Broker, Data Mover, Configuration Manager, FIN Common Objects, FIN Lease Administration, and CC Common Application Objects. The affected versions explicitly include 8.61 to 8.63 and 9.1 to 9.2. The fixes are part of Oracle's August 2026 Critical Security Patch Update, which includes 943 patches across various Oracle products. Oracle emphasizes the importance of applying these patches without delay to prevent exploitation of known vulnerabilities. No specific CVSS scores or detailed technical exploit information are provided in the advisory.

The vulnerabilities addressed by this update potentially expose Oracle PeopleSoft Enterprise PeopleTools and other Oracle products to security risks that could be exploited if patches are not applied. Oracle reports that attackers have attempted to exploit previously patched vulnerabilities when customers failed to apply updates. The impact is mitigated by applying the provided patches. No known exploits in the wild are reported for these specific vulnerabilities at this time.

Oracle has released official patches as part of the August 2026 Critical Security Patch Update to address these vulnerabilities. Customers should apply these patches promptly to affected versions 8.61 through 8.63 and 9.1 through 9.2 of Oracle PeopleSoft Enterprise PeopleTools. Oracle strongly recommends remaining on actively supported versions and applying all security patches without delay. Patch availability and installation instructions are provided in Oracle's official advisory.