CVE-2026-61103 in PeopleSoft Enterprise CS Campus Community
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise CS Campus Community executes to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38, specifically within the security component of the application. The flaw represents a significant security weakness that can be exploited by attackers who have physical access to the communication segment connected to the hardware executing the PeopleSoft application. This configuration creates an attack surface where network-level adversaries can potentially compromise the entire system without requiring authentication credentials. The vulnerability's classification as difficult to exploit indicates that while the attack requires specific conditions, the potential impact is severe enough to warrant immediate attention from security professionals.
The technical nature of this vulnerability stems from inadequate security controls that allow unauthorized access when an attacker can physically connect to the same network segment as the target system. This type of weakness typically involves improper access controls or insufficient network segmentation that enables lateral movement and data exfiltration. According to CWE standards, this scenario aligns with CWE-284 Access Control Issues, specifically involving inadequate access control mechanisms that permit unauthorized users to access protected resources. The vulnerability's CVSS score of 5.9 reflects the balance between the attack vector accessibility and the potential damage to confidentiality and integrity of the system.
The operational impact of successfully exploiting this vulnerability can be devastating for organizations relying on PeopleSoft Enterprise CS Campus Community for their academic and administrative operations. An attacker who gains unauthorized access could potentially view sensitive student records, financial information, and institutional data that should remain protected. The ability to perform unauthorized updates, inserts, or deletions provides attackers with the capability to modify critical data within the system, potentially causing significant disruption to academic processes, financial reporting, and institutional integrity. This vulnerability affects not only the immediate data stored in PeopleSoft but also potentially exposes other interconnected systems that may rely on the same network infrastructure.
Organizations should implement multiple layers of defense to mitigate this risk, including robust network segmentation to isolate critical applications from general network access, implementation of strong physical security controls, and regular monitoring of network traffic for suspicious activities. The ATT&CK framework categorizes this type of vulnerability under privilege escalation and credential access tactics where adversaries leverage network-level access to gain unauthorized system privileges. Security teams should conduct thorough network audits to identify all systems connected to potentially vulnerable network segments and implement proper access control lists. Additionally, regular security assessments and vulnerability scanning should be performed to identify similar weaknesses in the broader IT infrastructure that could be exploited through similar attack vectors.