CVE-2026-60610
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Vulnerability in Oracle PeopleSoft Enterprise CS Campus Community (component: Security) version 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to access critical data or all data. CVSS 5.9 (Confidentiality impact).
Risk Assessment
An attacker can access all data of the Campus Community system, including the most sensitive information, potentially leading to a severe data breach.
Recommendation
Apply the patch provided by Oracle in the Critical Patch Update (CPU) for PeopleSoft Enterprise CS Campus Community.
Other vulnerabilities in PeopleSoft Enterprise CS Campus Community
See all- CVE-2026-61103Medium
PeopleSoft Enterprise CS Campus Community version 9.2.38 has a vulnerability in the Security component. A difficult-to-exploit flaw allows an unauthenticated attacker with access to the physical communication segment to gain unauthorized access to critical data and partially modify data.
- CVE-2026-60614High
PeopleSoft Enterprise CS Campus Community (part of Oracle PeopleSoft) version 9.2.38 has a difficult-to-exploit vulnerability that can be used by a low-privileged attacker via HTTP. Successful attack can result in unauthorized access, data modification, and complete denial of service (hang or frequent crashes).
- CVE-2026-60611Medium
Vulnerability in Oracle PeopleSoft Enterprise CS Campus Community (component: Security) version 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to read a subset of data. CVSS 5.3 (Confidentiality impact).
- CVE-2026-60604High
Vulnerability in PeopleSoft Enterprise CS Campus Community (version 9.2.38) in Security component. Difficult to exploit, low-privileged attacker via HTTP can take over the system.
- CVE-2026-60594High
Vulnerability in PeopleSoft Enterprise CS Campus Community (Integration and Interfaces component) version 9.2.38. Low-privileged attacker via HTTP can take over the system.
- CVE-2021-2421Medium
Vulnerability in PeopleSoft Enterprise CS Campus Community product (component: Integration and Interfaces) versions 9.0 and 9.2. Allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data.
- CVE-2020-2912Medium
Vulnerability in PeopleSoft Enterprise CS Campus Community product (component: Self-Service) version 9.2. Allows a low privileged attacker with network access via HTTP to gain unauthorized read access to a subset of data, potentially impacting additional products.
- CVE-2017-3577Medium
Vulnerability in PeopleSoft Enterprise CS Campus Community component (subcomponent: Frameworks) version 9.2. Allows a high privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, modification, or access to critical data.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).