CVE-2026-60617 in PeopleSoft Enterprise CS Campus Community
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38, specifically affecting the security component of this enterprise application suite. The flaw represents a significant security weakness that can be exploited by unauthenticated attackers who gain network access through HTTP protocols. The vulnerability's classification as difficult to exploit indicates that while it requires some technical skill and knowledge to leverage effectively, the attack surface remains accessible to determined threat actors. This particular weakness stems from insufficient authentication mechanisms within the application's security framework, creating an entry point for malicious actors seeking unauthorized access to sensitive institutional data.
The technical nature of this vulnerability manifests as a privilege escalation issue that allows attackers to perform unauthorized operations against the PeopleSoft system without requiring valid credentials or authentication. The CVSS 3.1 score of 6.5 reflects the moderate severity of impact, with specific weaknesses in both confidentiality and integrity domains. Attackers who successfully exploit this flaw can achieve unauthorized creation, deletion, or modification of critical data within the application environment, potentially leading to complete data corruption or manipulation. Additionally, the vulnerability enables unauthorized read access to sensitive subsets of data that should normally be restricted to authorized personnel only.
The operational impact of this vulnerability extends beyond simple data compromise, as it affects the fundamental integrity and confidentiality of institutional information systems. Organizations utilizing PeopleSoft Enterprise CS Campus Community may face significant risks including data breaches, regulatory compliance violations, and potential exposure of sensitive student and administrative information. The attack vector through HTTP protocols suggests that organizations with web-facing applications or exposed network services are particularly vulnerable to exploitation attempts. This vulnerability represents a serious concern for educational institutions that rely on PeopleSoft for campus community management and may have implications for broader enterprise security postures.
Mitigation strategies should focus on immediate implementation of network-level controls including firewall restrictions, web application firewalls, and access control measures to limit exposure to this vulnerability. Organizations should prioritize patch management procedures and consult Oracle's official security advisories for recommended updates and security patches. Additional protective measures include implementing strong authentication mechanisms, regular security monitoring, and comprehensive access logging to detect potential exploitation attempts. The vulnerability aligns with CWE-287 (Improper Authentication) and may map to ATT&CK techniques related to credential access and privilege escalation. Regular security assessments and penetration testing should be conducted to verify the effectiveness of implemented controls and identify additional security gaps that could be exploited by sophisticated threat actors targeting enterprise applications.