CVE-2026-60598
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Vulnerability in PeopleSoft Enterprise CS Student Records (version 9.2.38) in Research Tracking component. Difficult to exploit, low-privileged attacker via HTTP can take over the system.
Risk Assessment
Risk of full system takeover, potentially leading to student data leakage and grade manipulation.
Recommendation
Immediately apply Oracle patches and restrict HTTP access for low-privileged accounts.
Other vulnerabilities in PeopleSoft Enterprise CS Student Records
See all- CVE-2026-60605High
In PeopleSoft Enterprise CS Student Records version 9.2.38, a vulnerability in the Higher Ed Statistics Agency - UK HESA component allows an unauthenticated attacker to remotely access critical data via HTTP. CVSS 7.5 (confidentiality).
- CVE-2026-60603High
Vulnerability in PeopleSoft Enterprise CS Student Records (Australian Features component) version 9.2.38. Low-privileged attacker via HTTP can take over the system.
- CVE-2026-60599High
Vulnerability in PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). Affects version 9.2.38. A low-privileged attacker with network access via HTTPS can compromise data confidentiality and integrity.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CS Student Records. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).