Oracle PeopleSoft CVE-2026-60598

Exploitation requires a valid low-privileged PeopleSoft account (CVSS PR:L - authenticated) and network HTTP access to the PeopleSoft Internet Architecture serving the Research Tracking component of CS Student Records version 9.2.38. It does not require user interaction (UI:N). Exploitation is limited by high attack complexity (AC:H), meaning the attacker must overcome conditions outside their direct control or win specific timing/state requirements, and by the need for the specific affected version and for the Research Tracking functionality to be deployed and reachable; these factors make reliable exploitation harder than the network vector alone suggests.

The CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: network-reachable but with high attack complexity and requiring low-privilege authentication, offset by full high impact to confidentiality, integrity, and availability. The AC:H and PR:L metrics meaningfully lower real-world exploitability - an attacker needs valid credentials and must overcome non-trivial conditions - so this is not a mass-exploitation candidate. There is no EPSS score, no POC, and no KEV listing in the provided data, and no SSVC decision points, which is consistent with a not-yet-widely-exploited issue. Oracle's 'Information Disclosure' tag conflicts with the CVSS claim of full integrity and availability impact; the CVSS vector should be treated as authoritative for takeover potential, but the discrepancy is worth noting. Overall this is a genuine High-severity priority for organizations running the exact affected version, but the required authentication and high complexity make it a targeted rather than opportunistic risk.

An attacker who has obtained or been granted a low-privilege PeopleSoft account (for example a student or staff self-service login) sends crafted authenticated HTTP requests to the Research Tracking functionality and, after satisfying the non-trivial conditions implied by the high attack complexity, escalates to full control of the Student Records module. This would expose and allow tampering with student academic and research records. No public proof-of-concept is available at time of analysis.