CVE-2026-60604
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Vulnerability in PeopleSoft Enterprise CS Campus Community (version 9.2.38) in Security component. Difficult to exploit, low-privileged attacker via HTTP can take over the system.
Risk Assessment
Risk of full system takeover, potentially exposing student data and disrupting campus operations.
Recommendation
Apply Oracle patches and strengthen access controls for low-privileged accounts.
Other vulnerabilities in PeopleSoft Enterprise CS Campus Community
See all- CVE-2026-61103Medium
PeopleSoft Enterprise CS Campus Community version 9.2.38 has a vulnerability in the Security component. A difficult-to-exploit flaw allows an unauthenticated attacker with access to the physical communication segment to gain unauthorized access to critical data and partially modify data.
- CVE-2026-60614High
PeopleSoft Enterprise CS Campus Community (part of Oracle PeopleSoft) version 9.2.38 has a difficult-to-exploit vulnerability that can be used by a low-privileged attacker via HTTP. Successful attack can result in unauthorized access, data modification, and complete denial of service (hang or frequent crashes).
- CVE-2026-60611Medium
Vulnerability in Oracle PeopleSoft Enterprise CS Campus Community (component: Security) version 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to read a subset of data. CVSS 5.3 (Confidentiality impact).
- CVE-2026-60610Medium
Vulnerability in Oracle PeopleSoft Enterprise CS Campus Community (component: Security) version 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to access critical data or all data. CVSS 5.9 (Confidentiality impact).
- CVE-2026-60594High
Vulnerability in PeopleSoft Enterprise CS Campus Community (Integration and Interfaces component) version 9.2.38. Low-privileged attacker via HTTP can take over the system.
- CVE-2021-2421Medium
Vulnerability in PeopleSoft Enterprise CS Campus Community product (component: Integration and Interfaces) versions 9.0 and 9.2. Allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data.
- CVE-2020-2912Medium
Vulnerability in PeopleSoft Enterprise CS Campus Community product (component: Self-Service) version 9.2. Allows a low privileged attacker with network access via HTTP to gain unauthorized read access to a subset of data, potentially impacting additional products.
- CVE-2017-3577Medium
Vulnerability in PeopleSoft Enterprise CS Campus Community component (subcomponent: Frameworks) version 9.2. Allows a high privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, modification, or access to critical data.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CS Campus Community. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).