CVE-2026-60599 in PeopleSoft Enterprise CS Student Records
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CS Student Records accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Student Records accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise CS Student Records version 9.2.38, specifically affecting the Research Tracking component. The flaw represents a significant security weakness that can be exploited by attackers with minimal privileges and network access through HTTPS protocols. The vulnerability's classification as easily exploitable indicates that the attack vector requires little technical sophistication or specialized tools to execute successfully.
The technical nature of this vulnerability stems from inadequate access controls within the Research Tracking module, allowing authenticated users with low privilege levels to perform unauthorized operations against the underlying data repository. This weakness specifically impacts the confidentiality and integrity aspects of the system as indicated by the CVSS 3.1 base score of 8.1, which reflects high severity consequences for both data modification and unauthorized access scenarios.
The operational impact of this vulnerability extends beyond simple data compromise, as successful exploitation can enable attackers to create, delete, or modify critical student records and academic data. This represents a severe breach of data integrity since malicious actors could alter grades, enrollment status, personal information, or other sensitive academic records that form the foundation of institutional operations. The potential for complete access to all accessible data within the PeopleSoft system means that attackers could potentially compromise the entire academic record database.
From a cybersecurity perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and represents a clear violation of the principle of least privilege. The CVSS vector analysis reveals an attack complexity of low (AC:L) indicating minimal technical requirements for exploitation, combined with low privilege requirements (PR:L) which means that even basic user accounts could leverage this weakness. The network access requirement (AV:N) suggests that the vulnerability can be exploited remotely without requiring physical presence or additional authentication mechanisms.
Organizations should implement immediate mitigations including strengthening authentication controls, implementing network segmentation to limit access to PeopleSoft systems, and conducting thorough privilege reviews. The ATT&CK framework would categorize this as a privilege escalation technique where attackers leverage existing accounts to gain unauthorized access to sensitive data repositories. Regular security assessments and monitoring of user activities within the Research Tracking component should be implemented to detect potential exploitation attempts.
The vulnerability demonstrates the critical importance of proper access control implementation in enterprise applications handling sensitive personal data. Educational institutions relying on PeopleSoft systems must ensure that all components undergo regular security testing and that appropriate compensating controls are deployed to prevent unauthorized data manipulation or access. Patch management procedures should be prioritized to address this vulnerability promptly, as the combination of low attack complexity and high impact makes it particularly dangerous in production environments.
The security implications extend beyond immediate data compromise to potential regulatory violations under privacy laws such as FERPA in educational contexts. Organizations must ensure that their incident response procedures include specific protocols for addressing access control breaches in student record systems, given the sensitive nature of the compromised data and the potential legal ramifications of unauthorized access or modification of academic records.