CVE-2026-60603
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Vulnerability in PeopleSoft Enterprise CS Student Records (Australian Features component) version 9.2.38. Low-privileged attacker via HTTP can take over the system.
Risk Assessment
Risk of full takeover of PeopleSoft Student Records, leading to student data breach.
Recommendation
Apply Oracle patch for version 9.2.38. Restrict network access.
Other vulnerabilities in PeopleSoft Enterprise CS Student Records
See all- CVE-2026-60605High
In PeopleSoft Enterprise CS Student Records version 9.2.38, a vulnerability in the Higher Ed Statistics Agency - UK HESA component allows an unauthenticated attacker to remotely access critical data via HTTP. CVSS 7.5 (confidentiality).
- CVE-2026-60599High
Vulnerability in PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). Affects version 9.2.38. A low-privileged attacker with network access via HTTPS can compromise data confidentiality and integrity.
- CVE-2026-60598High
Vulnerability in PeopleSoft Enterprise CS Student Records (version 9.2.38) in Research Tracking component. Difficult to exploit, low-privileged attacker via HTTP can take over the system.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Australian Features). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CS Student Records. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).