CVE-2026-60605
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
In PeopleSoft Enterprise CS Student Records version 9.2.38, a vulnerability in the Higher Ed Statistics Agency - UK HESA component allows an unauthenticated attacker to remotely access critical data via HTTP. CVSS 7.5 (confidentiality).
Risk Assessment
An attacker can gain full access to PeopleSoft Enterprise CS Student Records data, risking leakage of sensitive student data.
Recommendation
Apply the Oracle patch or update to a fixed version.
Other vulnerabilities in PeopleSoft Enterprise CS Student Records
See all- CVE-2026-60603High
Vulnerability in PeopleSoft Enterprise CS Student Records (Australian Features component) version 9.2.38. Low-privileged attacker via HTTP can take over the system.
- CVE-2026-60599High
Vulnerability in PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). Affects version 9.2.38. A low-privileged attacker with network access via HTTPS can compromise data confidentiality and integrity.
- CVE-2026-60598High
Vulnerability in PeopleSoft Enterprise CS Student Records (version 9.2.38) in Research Tracking component. Difficult to exploit, low-privileged attacker via HTTP can take over the system.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Higher Ed Statistics Agency - UK HESA). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Student Records accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).