CVE-2026-60615
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Vulnerability in Oracle PeopleSoft Enterprise CS Campus Community (component: Security). Affected version is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise the system. Successful attack can result in unauthorized access to critical data or full access to all accessible data, as well as unauthorized update, insert or delete access to some data.
Risk Assessment
Risk involves potential leakage of critical data and unauthorized modification by an external attacker without authentication.
Recommendation
Immediately apply patches provided by Oracle for version 9.2.38 and restrict network access to the system.
Other vulnerabilities in Oracle PeopleSoft
See all- CVE-2026-61240High
In PeopleSoft Enterprise FIN Common Objects Argentina (part of Oracle PeopleSoft) version 9.1, an easily exploitable vulnerability allows an unauthenticated attacker with access to the physical communication segment. Attacks may significantly impact additional products (scope change) and result in unauthorized access to critical data and modification capabilities.
- CVE-2026-61234High
Vulnerability in PeopleSoft Enterprise FIN Common Objects Brazil (part of Oracle PeopleSoft) version 9.1. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTP to unauthorizedly read and modify critical data. CVSS 7.4.
- CVE-2026-61210High
Vulnerability in PeopleSoft Enterprise SCM Manufacturing (part of Oracle PeopleSoft) version 9.2. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTPS to unauthorizedly read and modify critical data. CVSS 7.4.
- CVE-2026-61205High
Vulnerability in PeopleSoft Enterprise SCM Purchasing (part of Oracle PeopleSoft) version 9.2. An easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to unauthorizedly modify critical data and read a subset of data. CVSS 8.2.
- CVE-2026-61104Low
Vulnerability in Oracle PeopleSoft Enterprise CS Student Records (Research Tracking component) version 9.2.38. Difficult to exploit, allows unauthenticated attacker to gain unauthorized read access to a subset of data.
- CVE-2026-61088High
Vulnerability in PeopleSoft Enterprise SCM Manufacturing product of Oracle PeopleSoft, component Security. Affects version 9.2. An unauthenticated attacker can remotely access critical data or all data in the system via HTTP.
- CVE-2026-61087High
Vulnerability in PeopleSoft Enterprise FIN Payables product of Oracle PeopleSoft, component Security. Affects version 9.2. An unauthenticated attacker can remotely access critical data or all data in the system via HTTP.
- CVE-2026-61086High
Vulnerability in PeopleSoft Enterprise SCM Order Management product of Oracle PeopleSoft, component Security. Affects version 9.2. An unauthenticated attacker can remotely access critical data or all data in the system via HTTPS.
- CVE-2026-61085High
Vulnerability in PeopleSoft Enterprise SCM Inventory product of Oracle PeopleSoft, component Security. Affects version 9.2. An unauthenticated attacker can remotely access critical data or all data in the system via HTTPS.
- CVE-2026-61074High
Vulnerability in PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft, component eProcurement. Affects version 9.1. It is difficult to exploit, but an unauthenticated attacker can remotely take over the system via HTTP.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).