CVE-2026-60614 in PeopleSoft Enterprise CS Campus Community
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Person Data). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise CS Campus Community accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise CS Campus Community. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38 in the Person Data component, representing a significant security weakness that can be exploited by low-privileged attackers with network access through HTTP protocols. The flaw falls under the category of insufficient authorization controls and lacks proper input validation mechanisms, allowing malicious actors to manipulate person data records and potentially compromise the entire system's integrity. The vulnerability's CVSS 3.1 base score of 7.1 indicates a high severity threat level that combines confidentiality, integrity, and availability impacts.
The technical nature of this vulnerability stems from inadequate access controls within the Person Data component, which fails to properly validate user permissions before executing data modification operations. Attackers can leverage this weakness to perform unauthorized actions including creating, deleting, or modifying critical person records and associated data within the PeopleSoft system. The vulnerability requires minimal privileges to exploit and can be initiated through standard HTTP network connections, making it particularly dangerous as it bypasses normal authentication mechanisms that should prevent such unauthorized access patterns. This weakness aligns with CWE-284 (Improper Access Control) and may also relate to CWE-79 (Cross-site Scripting) if the vulnerability permits data injection attacks.
The operational impact of this vulnerability extends beyond simple data manipulation to include complete system availability disruption through denial-of-service conditions that can cause frequent crashes or system hangs. Successful exploitation enables attackers to access sensitive personal information stored in the campus community database while simultaneously allowing modification of critical records that could affect student enrollment, academic progress tracking, and administrative functions. The unauthorized read access to subset data suggests potential exposure of personally identifiable information including student records, faculty details, and institutional data that could be used for identity theft or other malicious activities.
Organizations must implement immediate mitigations including strengthening network access controls through firewalls and intrusion detection systems, applying available patches from Oracle as soon as they become available, and implementing additional monitoring for unusual data access patterns. The vulnerability demonstrates the importance of principle of least privilege enforcement and proper input validation in enterprise applications. Security teams should also consider implementing database activity monitoring to detect unauthorized modifications and establish incident response procedures specifically addressing PeopleSoft system compromises. This vulnerability aligns with ATT&CK technique T1078 (Valid Accounts) and T1499 (Endpoint Denial of Service) while potentially involving T1566 (Phishing) if attackers use social engineering to obtain initial low-privilege access before exploiting this weakness. Proper network segmentation and regular security assessments can help reduce the attack surface and prevent exploitation of similar vulnerabilities in other components of the PeopleSoft suite.