CVE-2026-60152: unauthorized data access

CISO Take

This CVE affects Oracle PeopleSoft Enterprise PeopleTools' Panel Processor component, an ERP administration layer with no discernible AI/ML functionality — the 'ml_ui' AI-category tag on this record appears to be a pipeline misclassification and should be reviewed rather than treated as an AI supply-chain finding. On its own merits it's a medium-severity issue (CVSS 5.4): an unauthenticated attacker over HTTP can gain unauthorized read access to a subset of PeopleTools data and unauthorized insert/update/delete on some data, but only if a legitimate user performs an action the attacker triggers (UI:R), which caps blast radius and rules out this being a wormable or fully remote-silent bug. EPSS sits at 0.24% (absolute low, though ranked in the top 85th percentile of all scored CVEs), there is no CISA KEV listing, no public exploit, and no Nuclei template, so near-term mass exploitation is unlikely. Action: PeopleTools 8.61/8.62 shops should apply Oracle's July 2026 Critical Patch Update (cpujul2026.html) through standard ERP patch management — this does not require AI/ML incident response involvement — and separately flag this record for taxonomy correction so it stops consuming AI threat-intel triage capacity.

Sources: NVD EPSS oracle.com

What is the risk?

Medium risk in absolute terms (CVSS 5.4, AV:N/AC:L/PR:N/UI:R/C:L/I:L/A:N). Low attack complexity and no privileges required lower the bar, but the mandatory user-interaction requirement means this is realistically a CSRF-style or click-triggered flaw rather than a directly remotely exploitable one. No confidentiality/integrity impact beyond partial (subset of data), and no availability impact. No active exploitation signals (not in KEV, no public PoC, no scanner template), so urgency is standard patch-cycle, not emergency.

How does the attack unfold?

Lure delivery

Attacker delivers a crafted link or embedded request to a currently-authenticated PeopleSoft user via phishing or a malicious webpage.

Triggered request

The victim's action (click/page load) causes their browser to submit the malicious request to the Panel Processor component using their active session.

Unauthorized data impact

Panel Processor processes the request without proper validation, granting the attacker unauthorized read access to a subset of PeopleTools data and/or unauthorized insert, update, or delete on other data.

Lure delivery

Attacker delivers a crafted link or embedded request to a currently-authenticated PeopleSoft user via phishing or a malicious webpage.

Triggered request

The victim's action (click/page load) causes their browser to submit the malicious request to the Panel Processor component using their active session.

Unauthorized data impact

Panel Processor processes the request without proper validation, granting the attacker unauthorized read access to a subset of PeopleTools data and/or unauthorized insert, update, or delete on other data.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 16% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C Low

I Low

A None

What should I do?

1 step

Apply the Oracle Critical Patch Update for PeopleTools referenced in the July 2026 CPU (https://www.oracle.com/security-alerts/cpujul2026.html) on all PeopleTools 8.61/8.62 instances. Since exploitation requires user interaction, reinforce standard anti-CSRF and click-protection hygiene for PeopleSoft web sessions (SameSite cookies, referrer checks) and user awareness against clicking unsolicited PeopleSoft links. Monitor PeopleTools access logs for anomalous Panel Processor requests correlated with unusual referrers. Separately, correct the AI-category tag on this record so it is excluded from AI/ML threat intelligence workflows.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Framework

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-60152?

This CVE affects Oracle PeopleSoft Enterprise PeopleTools' Panel Processor component, an ERP administration layer with no discernible AI/ML functionality — the 'ml_ui' AI-category tag on this record appears to be a pipeline misclassification and should be reviewed rather than treated as an AI supply-chain finding. On its own merits it's a medium-severity issue (CVSS 5.4): an unauthenticated attacker over HTTP can gain unauthorized read access to a subset of PeopleTools data and unauthorized insert/update/delete on some data, but only if a legitimate user performs an action the attacker triggers (UI:R), which caps blast radius and rules out this being a wormable or fully remote-silent bug. EPSS sits at 0.24% (absolute low, though ranked in the top 85th percentile of all scored CVEs), there is no CISA KEV listing, no public exploit, and no Nuclei template, so near-term mass exploitation is unlikely. Action: PeopleTools 8.61/8.62 shops should apply Oracle's July 2026 Critical Patch Update (cpujul2026.html) through standard ERP patch management — this does not require AI/ML incident response involvement — and separately flag this record for taxonomy correction so it stops consuming AI threat-intel triage capacity.

Is CVE-2026-60152 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-60152, increasing the risk of exploitation.

How to fix CVE-2026-60152?

Apply the Oracle Critical Patch Update for PeopleTools referenced in the July 2026 CPU (https://www.oracle.com/security-alerts/cpujul2026.html) on all PeopleTools 8.61/8.62 instances. Since exploitation requires user interaction, reinforce standard anti-CSRF and click-protection hygiene for PeopleSoft web sessions (SameSite cookies, referrer checks) and user awareness against clicking unsolicited PeopleSoft links. Monitor PeopleTools access logs for anomalous Panel Processor requests correlated with unusual referrers. Separately, correct the AI-category tag on this record so it is excluded from AI/ML threat intelligence workflows.

What is the CVSS score for CVE-2026-60152?

CVE-2026-60152 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.24%.

What are the technical details?

Original Advisory

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).

Exploitation Scenario

An attacker crafts a malicious link or embedded request targeting the PeopleTools Panel Processor endpoint and delivers it via phishing, a malicious webpage, or a compromised third-party site. When an already-authenticated PeopleSoft user clicks the link or loads the page while their session is active, their browser unknowingly submits the crafted HTTP request, allowing the attacker to read a subset of PeopleTools-accessible data or perform unauthorized insert/update/delete operations on some records, without ever needing valid credentials themselves.