CVE-2026-61104 in PeopleSoft Enterprise CS Student Records
Summary
by MITRE • 07/22/2026
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise CS Student Records accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle PeopleSoft Enterprise CS Student Records version 9.2.38, specifically within the Research Tracking component, representing a significant security weakness that affects organizations managing sensitive educational data. The flaw manifests as a difficulty in exploitation condition, meaning while it requires some technical skill to execute, it remains accessible to unauthenticated attackers who can leverage network-based HTTP access to compromise the system. This particular vulnerability operates under the CVSS 3.1 scoring system with a base score of 3.7, indicating a low to moderate severity classification that primarily impacts confidentiality aspects of the information system.
The technical nature of this vulnerability stems from inadequate access controls within the Research Tracking module, allowing unauthorized individuals to gain read access to specific subsets of student records data without requiring authentication credentials or privileged access. This represents a direct violation of the principle of least privilege and demonstrates insufficient input validation or authorization mechanisms within the application's security framework. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates network-based exploitation is required with high attack complexity, no privileges needed, no user interaction required, and only local confidentiality impact without modifications to integrity or availability.
From an operational standpoint, this vulnerability poses substantial risk to educational institutions maintaining student records within Oracle PeopleSoft environments, as it could potentially expose sensitive academic information, personal identifiers, and other confidential data elements. The compromise affects the integrity of data protection mechanisms and undermines trust in the organization's ability to secure sensitive student information. Organizations may face regulatory compliance issues under various data protection frameworks including but not limited to FERPA requirements for educational institutions, which mandate strict controls over student privacy and data access.
The vulnerability's impact aligns with CWE-284 (Improper Access Control) and maps to ATT&CK technique T1071.004 (Application Layer Protocol: DNS) in scenarios where attackers might leverage HTTP protocols to access restricted resources. Security professionals should consider implementing network-based controls including firewall rules that restrict access to PeopleSoft applications, deploying web application firewalls to monitor and filter HTTP traffic, and ensuring proper authentication mechanisms are enforced throughout the application stack. Organizations must also evaluate their current patch management processes to ensure timely deployment of Oracle security patches addressing this vulnerability.
Mitigation strategies should include immediate implementation of network segmentation to limit access to PeopleSoft servers, enforcement of strong authentication requirements for administrative functions, regular security assessments of web applications, and monitoring for anomalous access patterns that might indicate exploitation attempts. The vulnerability demonstrates the importance of maintaining up-to-date security controls and proper access management within enterprise applications, particularly those handling sensitive personal information. Organizations should also consider enhanced logging and audit capabilities to detect potential unauthorized access attempts and maintain comprehensive incident response procedures to address any successful exploitation attempts.