CVE-2026-60616 in PeopleSoft Enterprise CS Campus Community
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38, specifically affecting the security component of this enterprise application suite. The flaw represents a significant security weakness that can be exploited by unauthenticated attackers who have network access through HTTP protocols. The CVSS 3.1 base score of 6.5 indicates a medium to high severity vulnerability that primarily impacts confidentiality and integrity aspects of the system. The attack vector is classified as network-based with high complexity requirements, meaning an attacker needs to be able to establish network connectivity to the vulnerable system without requiring authentication credentials.
The technical nature of this vulnerability stems from insufficient access controls or authentication mechanisms within the PeopleSoft application's security framework. Attackers can potentially gain unauthorized access to critical data repositories and achieve complete access to all accessible data within the Campus Community module. This includes sensitive information such as student records, academic data, financial information, and other proprietary content that organizations typically consider highly confidential. The vulnerability also enables unauthorized modification capabilities, allowing attackers to insert, update, or delete data within certain portions of the system's database.
From an operational impact perspective, successful exploitation of this vulnerability can lead to severe consequences for organizations relying on PeopleSoft Enterprise CS Campus Community. The confidentiality breach could expose sensitive personal and academic information, potentially leading to identity theft or academic fraud. The integrity compromise allows attackers to manipulate student records, grades, enrollment data, or financial transactions, which could disrupt academic operations and create significant administrative challenges. Organizations may face regulatory compliance issues, legal consequences, and reputational damage from such security incidents.
The vulnerability's classification under CWE (Common Weakness Enumeration) would likely fall within categories related to insufficient authentication or access control mechanisms, potentially mapping to CWE-287 for improper authentication or CWE-312 for exposure of sensitive information. From an ATT&CK framework perspective, this vulnerability aligns with techniques such as T1190 for exploit public-facing application and T1071.004 for application layer protocol usage. The attack surface is particularly concerning given that it requires only network access via HTTP, making it accessible to attackers who may be conducting reconnaissance or automated scanning activities against exposed web services.
Organizations should implement immediate mitigations including network segmentation to limit access to PeopleSoft applications, implementing robust firewall rules to restrict HTTP access, and applying the latest security patches provided by Oracle. Additional protective measures include monitoring for unusual network activity, implementing intrusion detection systems, and establishing proper access controls for administrative functions. Regular vulnerability assessments and penetration testing should be conducted to identify potential exploitation vectors, while security awareness training for administrators can help prevent social engineering attacks that might complement this technical vulnerability. The implementation of web application firewalls and additional authentication mechanisms would provide layered protection against such threats.