What is the CVSS score of CVE-2026-60602?

CVE-2026-60602 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of PeopleSoft Student Financials are affected by CVE-2026-60602?

A vulnerability in Oracle PeopleSoft Student Financials 9.2.38 allows any employee with basic system access to take full control of the billing application, risking unauthorized access to student…

How to fix or mitigate CVE-2026-60602?

Within 24 hours: Identify all systems running Oracle PeopleSoft Enterprise CS Student Financials 9.2.38 and audit which employees have access to the Billing component. Within 7 days: Restrict network access to the Billing component to only essential staff; enable detailed logging of all user activity in the Billing module; deploy Web Application Firewall (WAF) protection to detect exploitation attempts. Within 30 days: Monitor Oracle for a patched version (9.2.39 or later); conduct security testing of the patch in a non-production environment; develop and execute an upgrade plan for all affected production systems.

PeopleSoft Student Financials CVE-2026-60602

EUVD-2026-46960 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-7wx4-96fx-cvwq

Authentication Bypass Oracle Peoplesoft Enterprise Cs Student Financials

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Authenticated low-privilege HTTP access (PR:L) with low complexity yields full application takeover, so C:H/I:H/A:H and unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:25 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Student Financials product of Oracle PeopleSoft (component: Billing). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Financials. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CS Student Financials. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full product takeover in Oracle PeopleSoft Enterprise CS Student Financials 9.2.38 (Billing component) allows a low-privileged, authenticated attacker with HTTP network access to compromise the application, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8) indicates easy exploitation yielding complete confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

PeopleSoft Enterprise Campus Solutions (CS) Student Financials is Oracle's higher-education module for student billing, receivables, refunds, and payment processing, delivered through the PeopleSoft PIA (PeopleSoft Internet Architecture) web tier over HTTP/HTTPS. The affected Billing component handles charge generation and account activity for students. Oracle did not assign a CWE (CWE: N/A), so the precise root-cause class is unconfirmed; the 'takeover' outcome combined with an authenticated network vector and the vendor's 'Information Disclosure' tag is consistent with an injection or access-control/authorization defect reachable through an authenticated PIA servlet, but the exact weakness cannot be determined from the provided data. The only affected version is CS Student Financials 9.2.38 (confirmed by both Oracle and the ENISA EUVD entry).

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, which contains the fix for this issue (patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle does not publish a discrete component fix-version number, so apply the CPU bundle that covers CS Student Financials 9.2.38 rather than a standalone version. Oracle notes CPU patches are cumulative and strongly recommends staying current. Because PR:L is required, meaningful compensating controls until patching is complete include restricting network reachability of the PeopleSoft PIA/Billing endpoints to trusted internal networks or VPN, tightening self-service role permissions so untrusted or student accounts cannot reach Billing functionality, enforcing MFA on all PeopleSoft accounts to reduce credential-theft-driven access, and increasing monitoring of Billing component activity and web-tier logs; the trade-off is that restricting self-service access may disrupt legitimate student billing workflows.