CVE-2026-60612
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Vulnerability in PeopleSoft Enterprise CS Financial Aid of Oracle PeopleSoft (component: Commonline Loans). Affects version 9.2.38. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and modify it.
Risk Assessment
Risk includes compromise of confidentiality and integrity of financial aid data, potentially leading to unauthorized changes in loan awards.
Recommendation
Apply the Oracle patch. Strengthen authentication and monitor access to the Financial Aid system.
Other vulnerabilities in Oracle PeopleSoft
See all- CVE-2026-61240High
In PeopleSoft Enterprise FIN Common Objects Argentina (part of Oracle PeopleSoft) version 9.1, an easily exploitable vulnerability allows an unauthenticated attacker with access to the physical communication segment. Attacks may significantly impact additional products (scope change) and result in unauthorized access to critical data and modification capabilities.
- CVE-2026-61234High
Vulnerability in PeopleSoft Enterprise FIN Common Objects Brazil (part of Oracle PeopleSoft) version 9.1. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTP to unauthorizedly read and modify critical data. CVSS 7.4.
- CVE-2026-61210High
Vulnerability in PeopleSoft Enterprise SCM Manufacturing (part of Oracle PeopleSoft) version 9.2. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTPS to unauthorizedly read and modify critical data. CVSS 7.4.
- CVE-2026-61205High
Vulnerability in PeopleSoft Enterprise SCM Purchasing (part of Oracle PeopleSoft) version 9.2. An easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to unauthorizedly modify critical data and read a subset of data. CVSS 8.2.
- CVE-2026-61104Low
Vulnerability in Oracle PeopleSoft Enterprise CS Student Records (Research Tracking component) version 9.2.38. Difficult to exploit, allows unauthenticated attacker to gain unauthorized read access to a subset of data.
- CVE-2026-61088High
Vulnerability in PeopleSoft Enterprise SCM Manufacturing product of Oracle PeopleSoft, component Security. Affects version 9.2. An unauthenticated attacker can remotely access critical data or all data in the system via HTTP.
- CVE-2026-61087High
Vulnerability in PeopleSoft Enterprise FIN Payables product of Oracle PeopleSoft, component Security. Affects version 9.2. An unauthenticated attacker can remotely access critical data or all data in the system via HTTP.
- CVE-2026-61086High
Vulnerability in PeopleSoft Enterprise SCM Order Management product of Oracle PeopleSoft, component Security. Affects version 9.2. An unauthenticated attacker can remotely access critical data or all data in the system via HTTPS.
- CVE-2026-61085High
Vulnerability in PeopleSoft Enterprise SCM Inventory product of Oracle PeopleSoft, component Security. Affects version 9.2. An unauthenticated attacker can remotely access critical data or all data in the system via HTTPS.
- CVE-2026-61074High
Vulnerability in PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft, component eProcurement. Affects version 9.1. It is difficult to exploit, but an unauthenticated attacker can remotely take over the system via HTTP.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise CS Financial Aid product of Oracle PeopleSoft (component: Commonline Loans). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Financial Aid. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CS Financial Aid accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Financial Aid accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).