PeopleSoft Student Financials CVE-2026-60602

Exploitation requires authenticated HTTP access to the PeopleSoft Enterprise CS Student Financials Billing component on version 9.2.38 - specifically a low-privileged account on the PeopleSoft instance (PR:L confirms authentication is needed, so this is not exploitable pre-authentication). Limiting factors: the attacker must already possess valid credentials of any privilege level and must be able to reach the PeopleSoft Internet Architecture web tier over the network; only the 9.2.38 CS Student Financials deployment is stated as affected. No user interaction, elevated privileges, or special non-default configuration is required beyond having a valid low-privilege login and network path to the Billing HTTP endpoints.

The signals point to a genuine but access-gated priority. CVSS 3.1 is 8.8 (High) with AV:N/AC:L/PR:L/UI:N - network-reachable, low attack complexity, no user interaction, and full C/I/A impact - meaning any account with even minimal privileges on the PeopleSoft instance can drive it. The mitigating factor is PR:L: this is not an unauthenticated internet drive-by; the attacker needs valid low-privilege credentials (e.g., a student or staff self-service account), which greatly narrows the practical threat to insiders or attackers who have already phished/obtained a foothold account. No KEV listing and no POC were provided, and no EPSS score was supplied, so exploitation is unproven and likely not yet widespread. Note a data conflict to verify: Oracle's tag says 'Information Disclosure,' yet the description and vector claim full 'takeover' with I:H/A:H - treat the impact as full takeover per the authoritative CVSS vector, but confirm scope with the Oracle advisory.

An attacker who holds or steals a low-privilege PeopleSoft self-service account (for example, a student or junior staff login) sends crafted authenticated HTTP requests to the Student Financials Billing component. Because attack complexity is low and no user interaction is needed, the attacker escalates to full compromise of the Student Financials application, exposing and altering student financial records. No public POC was provided, so this remains a plausible rather than demonstrated attack path.