CVE-2026-61104
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Vulnerability in Oracle PeopleSoft Enterprise CS Student Records (Research Tracking component) version 9.2.38. Difficult to exploit, allows unauthenticated attacker to gain unauthorized read access to a subset of data.
Risk Assessment
An attacker can access sensitive student data, compromising confidentiality and potentially leading to information leakage.
Recommendation
Apply the Oracle patch. Restrict network access to the PeopleSoft system and monitor logs for suspicious HTTP requests.
Original NVD description (English source)
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise CS Student Records accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).