What is the CVSS score of CVE-2026-60598?

CVE-2026-60598 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-60598?

Oracle PeopleSoft Enterprise CS Student Records version 9.2.38 contains a high-severity vulnerability in its Research Tracking component that allows authenticated low-privilege users to achieve…

How to fix or mitigate CVE-2026-60598?

Within 24 hours, restrict HTTP access to Oracle PeopleSoft Enterprise CS Student Records v9.2.38 to trusted administrative networks and immediately audit all user accounts to identify and disable unnecessary low-privilege access to the Research Tracking component. Within 7 days, enable comprehensive audit logging for all HTTP requests to the application, conduct a detailed access review to enforce least-privilege principles, and brief leadership on the unpatched vulnerability status. Within 30 days, establish direct engagement with Oracle to track patch availability, develop a migration plan for version upgrades when patches become available, and implement network segmentation to isolate the PeopleSoft infrastructure from general institutional network access.

Oracle PeopleSoft CVE-2026-60598

EUVD-2026-46956 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-pm55-483q-6w39

Authentication Bypass Oracle Peoplesoft Enterprise Campus Software Campus Community

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network HTTP reachable but authenticated (PR:L) with high complexity (AC:H); Oracle describes full takeover, so C/I/A all High and scope unchanged.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:27 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CS Student Records. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle PeopleSoft Enterprise CS Student Records version 9.2.38 (Research Tracking component) allows an authenticated, low-privileged attacker with network HTTP access to take over the module, impacting confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 7.5 despite high attack complexity (AC:H), reflecting the severity of a complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

PeopleSoft Enterprise Campus Solutions (CS) is Oracle's ERP suite for higher-education institutions; the affected Research Tracking functionality sits within the Student Records module and is exposed over HTTP through the PeopleSoft Internet Architecture (PIA) web/application-server tier. The flaw is reached via authenticated HTTP requests, consistent with a web-facing application-logic or access-control weakness rather than a network-protocol bug. No CWE was assigned by Oracle or NVD, so the precise root-cause class (e.g., injection, broken access control, or deserialization) cannot be confirmed from the available data; Oracle's own tag of 'Information Disclosure' is narrower than the CVSS vector, which indicates full C/I/A takeover.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle distributes PeopleSoft security fixes as CPU patches rather than a renamed release, so no discrete fixed version number is enumerated in the input and administrators should apply the CPU-July-2026 bundle for PeopleSoft Enterprise CS 9.2. Patch available per vendor advisory. Until the CPU is applied, compensating controls include restricting network access to the Research Tracking functionality and the PIA endpoints to trusted institutional networks or VPN, tightening role/permission-list access so that only necessary users hold the low-privilege access that enables exploitation, and increasing monitoring of authenticated activity against Student Records; the trade-off is that access restrictions can disrupt legitimate staff and student self-service workflows, so scope them to the affected component where possible.