CVE-2026-60614
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
PeopleSoft Enterprise CS Campus Community (part of Oracle PeopleSoft) version 9.2.38 has a difficult-to-exploit vulnerability that can be used by a low-privileged attacker via HTTP. Successful attack can result in unauthorized access, data modification, and complete denial of service (hang or frequent crashes).
Risk Assessment
An attacker can access personal data, modify it, and cause complete system unavailability, severely disrupting campus operations.
Recommendation
Apply the security patch provided by Oracle. Restrict access to the application and monitor for unusual activity.
Other vulnerabilities in PeopleSoft Enterprise CS Campus Community
See all- CVE-2026-61103Medium
PeopleSoft Enterprise CS Campus Community version 9.2.38 has a vulnerability in the Security component. A difficult-to-exploit flaw allows an unauthenticated attacker with access to the physical communication segment to gain unauthorized access to critical data and partially modify data.
- CVE-2026-60611Medium
Vulnerability in Oracle PeopleSoft Enterprise CS Campus Community (component: Security) version 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to read a subset of data. CVSS 5.3 (Confidentiality impact).
- CVE-2026-60610Medium
Vulnerability in Oracle PeopleSoft Enterprise CS Campus Community (component: Security) version 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to access critical data or all data. CVSS 5.9 (Confidentiality impact).
- CVE-2026-60604High
Vulnerability in PeopleSoft Enterprise CS Campus Community (version 9.2.38) in Security component. Difficult to exploit, low-privileged attacker via HTTP can take over the system.
- CVE-2026-60594High
Vulnerability in PeopleSoft Enterprise CS Campus Community (Integration and Interfaces component) version 9.2.38. Low-privileged attacker via HTTP can take over the system.
- CVE-2021-2421Medium
Vulnerability in PeopleSoft Enterprise CS Campus Community product (component: Integration and Interfaces) versions 9.0 and 9.2. Allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data.
- CVE-2020-2912Medium
Vulnerability in PeopleSoft Enterprise CS Campus Community product (component: Self-Service) version 9.2. Allows a low privileged attacker with network access via HTTP to gain unauthorized read access to a subset of data, potentially impacting additional products.
- CVE-2017-3577Medium
Vulnerability in PeopleSoft Enterprise CS Campus Community component (subcomponent: Frameworks) version 9.2. Allows a high privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, modification, or access to critical data.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Person Data). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise CS Campus Community accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise CS Campus Community. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).