CVE-2026-60603 in PeopleSoft Enterprise CS Student Records
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Australian Features). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CS Student Records. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise CS Student Records version 9.2.38, specifically affecting the Australian Features component of the PeopleSoft platform. The flaw represents a critical security weakness that can be exploited by attackers with minimal privileges and network access through standard HTTP protocols. The vulnerability's classification as easily exploitable indicates that attackers require no specialized skills or tools to leverage this weakness effectively, making it particularly dangerous in production environments where such systems handle sensitive educational data.
The technical nature of this vulnerability stems from insufficient input validation or authentication mechanisms within the Australian Features module, which allows a low-privileged attacker to execute unauthorized operations against the student records system. This weakness enables attackers to potentially gain full control over the affected PeopleSoft instance, effectively compromising the entire student records database and related functionalities. The CVSS 3.1 score of 8.8 reflects the high severity impact across all three core security principles: confidentiality, integrity, and availability, indicating that successful exploitation could lead to complete system compromise.
The operational impact of this vulnerability extends beyond simple data theft or modification, as it could result in complete system takeover allowing attackers to manipulate student records, access confidential academic information, and potentially disrupt educational services. Organizations running this version of PeopleSoft face significant risk of data breaches affecting thousands of student records, which could lead to regulatory compliance violations under various privacy frameworks including GDPR and local education data protection laws. The vulnerability's network accessibility means that attackers could potentially exploit it from external networks without requiring physical system access or elevated privileges.
Security professionals should immediately implement mitigations including applying the relevant Oracle patch releases, implementing network segmentation to limit access to PeopleSoft systems, and conducting thorough network monitoring for suspicious HTTP traffic patterns. Organizations should also review their access controls and privilege management policies to minimize the attack surface available to low-privileged users. This vulnerability aligns with CWE 284 (Improper Access Control) and may map to ATT&CK techniques involving privilege escalation and persistence within enterprise applications, making it a critical concern for cybersecurity teams managing educational technology infrastructure. The affected system configuration requires immediate attention as the vulnerability could enable attackers to establish long-term access to sensitive student information systems.