CVE-2026-60598 in PeopleSoft Enterprise CS Student Records
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CS Student Records. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise CS Student Records version 9.2.38, specifically within the Research Tracking component of the broader PeopleSoft suite. The flaw represents a critical security weakness that can be exploited by unauthenticated attackers with network access through HTTP protocols. The CVSS 3.1 score of 7.5 indicates a high-severity vulnerability that compromises all three core security principles: confidentiality, integrity, and availability. This assessment places the vulnerability in the category of difficult-to-exploit but potentially devastating attacks that could lead to complete system compromise.
The technical nature of this vulnerability stems from insufficient access controls or input validation mechanisms within the Research Tracking module. Attackers with low privileges can leverage network-based HTTP connections to exploit weaknesses in the application's authentication and authorization frameworks. The CVSS vector analysis reveals that the attack requires network access with high complexity, suggesting that while the vulnerability is not trivial to exploit, it does not require specialized tools or extensive knowledge beyond basic web application exploitation techniques. The lack of user interaction requirements means that attackers can potentially automate the exploitation process without user cooperation.
The operational impact of this vulnerability extends far beyond simple data compromise, as successful exploitation could result in complete takeover of the PeopleSoft Enterprise CS Student Records system. This would allow attackers to gain full administrative control over student records management, potentially enabling them to modify academic transcripts, grades, enrollment status, and other sensitive educational data. The confidentiality impact is severe given that student personal information, academic records, and institutional data could be accessed by unauthorized parties. Integrity impacts are equally concerning as attackers could alter or corrupt critical academic information, potentially affecting student outcomes and institutional reputation. Availability concerns arise from the possibility of denial-of-service attacks or complete system compromise that would prevent legitimate users from accessing essential student record services.
Organizations should implement immediate mitigations including network segmentation to limit access to PeopleSoft applications, deployment of web application firewalls to monitor and filter HTTP traffic, and mandatory patching of affected systems. The vulnerability aligns with CWE-285 (Improper Authorization) and CWE-311 (Missing Encryption of Sensitive Data) categories, indicating both authorization failures and potential data exposure issues. From an ATT&CK framework perspective, this vulnerability maps to techniques such as T1190 (Exploit Public-Facing Application) and T1078 (Valid Accounts), as attackers would leverage publicly accessible web interfaces while potentially using compromised credentials to escalate privileges. Regular security assessments should be conducted to identify similar vulnerabilities in other PeopleSoft components and ensure that access controls are properly configured throughout the enterprise application landscape.