Ask whether Integration Broker is “hardened” and you will get a nod about SSL and a shrug about nodes.
Ask which hosts can reach /PSIGW/HttpListeningConnector, whether ANONYMOUS still runs as a superuser, which nodes still have AUTHOPTN = N, and whether the PSKEY password is still password — and you will get a pause.
That pause stopped being theoretical on August 18. CVE-2026-60831 (CVSS 8.1, PeopleTools 8.61–8.63, Integration Broker) lets an unauthenticated attacker with HTTP access attempt takeover. Oracle rated it difficult. Successful attacks still mean full compromise.
🔗 CVE-2026-60831 (Tenable) https://www.tenable.com/cve/CVE-2026-60831
🔗 Oracle Critical Security Patch Update Advisory — August 2026 (Oracle) https://www.oracle.com/security-alerts/cspuaug2026.html
And the path is not new. Trend Micro’s June write-up of CVE-2026-35273 put the same gateway in writing: unauthenticated POST /PSIGW/HttpListeningConnector as the SSRF entry that reached an internal hub. Waratek’s August CSPU analysis put /PSIGW/ next to the published indicators from the ShinyHunters campaign.
🔗 PeopleSoft PeopleTools Pre-Authentication RCE (Trend Micro) https://www.trendmicro.com/en/research/26/f/PeopleTools.html
🔗 Oracle Ships Its Largest Monthly Security Update (Waratek) https://waratek.com/news/oracle-largest-monthly-security-update/
Patching closes one CVE. Boring Integration Broker closes the class. Here are five ways to replace the shrug with evidence.
1. Prove who can reach /PSIGW/ — from outside your diagram
Not a network diagram. An evidence pass: for every web tier, record whether HttpListeningConnector answers from the internet, from partner networks, and from internal subnets that should never talk to the gateway.
Trend’s first recommendation after the June chain: take /PSIGW/HttpListeningConnector off untrusted networks and put the Integration Broker gateway behind controls that restrict who can reach it. Waratek’s August note is the same door with a new CVE number attached.
Write the result as a table: environment, hostname, external DNS, last external probe date, allow-list owners. If the table does not exist, you do not have an IB exposure control. You have hope.
Also break the old SSRF pivot while you are there: segment the gateway from PSEMHUB so a gateway-originated loopback cannot satisfy validateClient. That is Trend’s second recommendation — still relevant after the June patch if your network topology never changed.
2. Prove August’s IB patch is installed — then stage Tuesday’s CSPU
“We applied August” is a claim. The artifact is the PeopleTools patch level that includes CVE-2026-60831, on every 8.61 / 8.62 / 8.63 environment that runs a gateway.
Oracle’s September CSPU pre-release is already live: 714 patches overall; PeopleSoft 16 patches, 4 unauthenticated, ceiling 8.8; PeopleTools 8.61–8.63 listed again. Release is Tuesday, September 15.
🔗 Oracle Critical Security Patch Update — September 2026 Pre-Release (Oracle) https://www.oracle.com/security-alerts/cspusep2026.html
For each environment: August IB patch yes/no, current PeopleTools maintenance level, Sep 15 CAB owner, rollback owner. Until that file exists, “we’re current” is storytelling.
3. Make ANONYMOUS boring — or turn it off where it should be
If a client hits the gateway without node credentials, Integration Broker falls back to the ANONYMOUS node and runs as that node’s Default User ID. Cedar Hills Group’s Missing Manual and Integrigy’s IB checklist both draw the same red line: that default user must not be PS, VP1, or any other high-privilege profile, and the routings attached to ANONYMOUS must be the short list of operations you actually intend to expose without credentials.
🔗 Properly Securing the ANONYMOUS IB Node (Cedar Hills / Integration Broker: The Missing Manual) https://ib.books.cedarhillsgroup.com/security/anonymous-node-security/
🔗 PeopleSoft Integration Broker (IB) Security (Integrigy) https://www.integrigy.com/security-resources/peoplesoft-integration-broker-ib-security
Concrete pass this week: open the ANONYMOUS node, record the Default User ID, export its Web Service Security, list active Any-to-Local or anonymous-facing routings, and kill anything that does not belong in production (PTF messages are a common leftover). Create a dedicated least-privilege user if you still need anonymous fall-back at all.
4. Kill AUTHOPTN = N and Any-to-Local — one node at a time
psLens put the quiet finding in writing: a node with AUTHOPTN = 'N' accepts messages without authenticating the sender. Cedar Hills’ node best practices are blunt: never use authentication option “none,” never share one node across partners, give each node a unique Default User ID with no interactive login, and never use Any-to-Local routings when you can name the endpoints.
🔗 Your PeopleSoft Nodes Probably Don’t Have Passwords (psLens) https://pslens.com/blog/peoplesoft-nodes-without-passwords/
🔗 Node Best Practices (Cedar Hills / Integration Broker: The Missing Manual) https://ib.books.cedarhillsgroup.com/nodes/node-security-best-practices/
Query PSMSGNODEDEFN for active nodes with AUTHOPTN = 'N' (or password auth with an empty password — functionally the same). Cross that list to inbound routings. Fix DEV first; a mismatched node password is a quiet way to break an interface, which is exactly why shops leave auth off. The dated CSV — node, auth option, default user, inbound routing count — is the control. “Nodes look fine” is not.
5. Change the default PSKEY and put encrypted keystore passwords in writing
Integrigy’s quick reference is still the shortest version: the PSKEY keystore holds root and node certificates for the Integration Gateway and PIA; the default password is password. Change it with pskeymanager (pskeymanager.sh -changeKeystorePassword), then update the encrypted secureFileKeystorePasswd in the gateway properties and WebLogic.
Oracle’s PeopleTools docs make the failure mode explicit: integrations fail if secureFileKeystorePath and an encrypted secureFileKeystorePasswd are missing. Require TLS for inbound requests while you are in the same change window.
🔗 Configuring Security and General Properties (Oracle PeopleTools documentation) https://docs.oracle.com/cd/G41075_01/pt862pbr3/eng/pt/tiba/ConfiguringSecurityandGeneralProperties-497d0b.html
Artifact: date of last PSKEY password change, who owns the keystore, proof the gateway property is encrypted (not cleartext), and TLS required for inbound. If that page is blank, your certificate story is still the install default.
Do this once, then make it an artifact
Five files, not five opinions: the /PSIGW/ exposure table, the August-IB / Sep-15 patch matrix, the ANONYMOUS user-and-routing export, the AUTHOPTN/Any-to-Local CSV, and the PSKEY/keystore change record.
Re-run the exposure probe and the node query after every CSPU. The diff is the control. “Integration Broker is hardened” is not.
Monday’s Digest covered why this week is the deadline: September CSPU pre-release with 714 patches and PeopleSoft back on the list (16 patches, 4 unauthenticated, ceiling 8.8, PeopleTools 8.61–8.63); August’s CVE-2026-60831 still sitting on Integration Broker at CVSS 8.1; /PSIGW/ still the path Waratek and Trend keep naming; Tax Update 26-C still aimed at September 30.
Next Thursday: 5 ways to model the real cost of staying on PeopleSoft.
🌐 Join the Community
Subscribe to PeopleSoft Cloud — practitioner posts every Thursday, the Modern ERP Digest every Monday.
✅ Concrete actions you can run this week, not advice ✅ Sources cited, costs stated honestly ✅ Free, always