Peoplesoft Enterprise Campus Software Campus Community CVE-2026-60599

Oracle PeopleSoft Enterprise CS Student Records 9.2.38 contains an authentication bypass vulnerability (CVE-2026-60599) allowing low-privileged authenticated users to read, create, delete, and modify all data accessible to the Research Tracking module. This represents a complete compromise of student records confidentiality and integrity, exposing educational and personal information to unauthorized internal actors. Organizations using this version face significant regulatory and reputational risk from unauthorized access to sensitive educational data.

Within 24 hours, audit access logs for the Research Tracking component and inventory all instances running PeopleSoft 9.2.38 to establish exposure scope. Within 7 days, contact Oracle for patch availability and timeline; implement network segmentation to restrict module access to essential personnel and implement enhanced audit logging with alerting for unauthorized student records modifications. Within 30 days, establish a firm upgrade schedule to a patched version once released by Oracle and deploy SIEM monitoring to detect unauthorized data access or modification attempts within the module.

No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the Research Tracking component using firewall segmentation; disable the module if not operationally critical; apply principle of least privilege to all module accounts; implement database-level audit logging with real-time alerting for create/modify/delete operations on student records; monitor for unusual access patterns using SIEM tools; restrict module access to predefined IP ranges if feasible.