CVE-2026-61103
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
PeopleSoft Enterprise CS Campus Community version 9.2.38 has a vulnerability in the Security component. A difficult-to-exploit flaw allows an unauthenticated attacker with access to the physical communication segment to gain unauthorized access to critical data and partially modify data.
Risk Assessment
An attacker can gain full access to all system data and partially modify data, posing a serious threat to information confidentiality and integrity.
Recommendation
Apply appropriate physical and network security measures to restrict access to the communication segment. Consider updating to a newer version of the product.
Other vulnerabilities in PeopleSoft Enterprise CS Campus Community
See all- CVE-2026-60614High
PeopleSoft Enterprise CS Campus Community (part of Oracle PeopleSoft) version 9.2.38 has a difficult-to-exploit vulnerability that can be used by a low-privileged attacker via HTTP. Successful attack can result in unauthorized access, data modification, and complete denial of service (hang or frequent crashes).
- CVE-2026-60611Medium
Vulnerability in Oracle PeopleSoft Enterprise CS Campus Community (component: Security) version 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to read a subset of data. CVSS 5.3 (Confidentiality impact).
- CVE-2026-60610Medium
Vulnerability in Oracle PeopleSoft Enterprise CS Campus Community (component: Security) version 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to access critical data or all data. CVSS 5.9 (Confidentiality impact).
- CVE-2026-60604High
Vulnerability in PeopleSoft Enterprise CS Campus Community (version 9.2.38) in Security component. Difficult to exploit, low-privileged attacker via HTTP can take over the system.
- CVE-2026-60594High
Vulnerability in PeopleSoft Enterprise CS Campus Community (Integration and Interfaces component) version 9.2.38. Low-privileged attacker via HTTP can take over the system.
- CVE-2021-2421Medium
Vulnerability in PeopleSoft Enterprise CS Campus Community product (component: Integration and Interfaces) versions 9.0 and 9.2. Allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data.
- CVE-2020-2912Medium
Vulnerability in PeopleSoft Enterprise CS Campus Community product (component: Self-Service) version 9.2. Allows a low privileged attacker with network access via HTTP to gain unauthorized read access to a subset of data, potentially impacting additional products.
- CVE-2017-3577Medium
Vulnerability in PeopleSoft Enterprise CS Campus Community component (subcomponent: Frameworks) version 9.2. Allows a high privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, modification, or access to critical data.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise CS Campus Community executes to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).