What is the CVSS score of CVE-2026-60603?

CVE-2026-60603 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-60603?

Oracle PeopleSoft Campus Solutions version 9.2.38 with Australian Features contains a high-severity vulnerability allowing low-privileged users to gain complete system access and compromise student…

How to fix or mitigate CVE-2026-60603?

Within 24 hours: identify all systems running PeopleSoft Campus Solutions 9.2.38 with the Australian Features component enabled, verify current user access logs for suspicious activity from low-privileged accounts, and document current security configurations. Within 7 days: implement network segmentation to restrict low-privileged user access to sensitive functions, enable enhanced logging and monitoring of user activities within the Campus Solutions module, and restrict HTTP network access to the application through firewall rules where operationally feasible. Within 30 days: monitor Oracle's advisory updates for patch availability, conduct a security assessment of current user privilege assignments to minimize attack surface, and develop an emergency patching plan for immediate deployment when Oracle releases a fix.

Oracle PeopleSoft CVE-2026-60603

EUVD-2026-46961 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-v8wf-j4qf-rmm4

Authentication Bypass Oracle Peoplesoft Enterprise Campus Software Campus Community

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP vector and 'easily exploitable' support AV:N/AC:L; a valid low-level account is required so PR:L, and full module takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:25 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Australian Features). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CS Student Records. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Privilege-escalating takeover of Oracle PeopleSoft Enterprise CS Student Records (Campus Solutions) 9.2.38, specifically the Australian Features component, allows a low-privileged attacker with only HTTP network access to fully compromise the module. Per Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8), a single valid low-level application account is enough to achieve complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed via the Oracle Critical Patch Update of July 2026.

Technical ContextAI

PeopleSoft Enterprise Campus Solutions (CS) Student Records is Oracle's higher-education student information system, deployed as a PeopleTools web-based application (typically fronted by WebLogic/PIA over HTTP/HTTPS with a backing Oracle Database). The flaw resides in the 'Australian Features' localization component of the Student Records module, an Australia-specific reporting/compliance extension. Oracle does not assign a CWE for this CVE, and the advisory does not disclose the internal defect class; the combination of network HTTP vector, low-privilege requirement, and full C/I/A impact is consistent with an authenticated injection or access-control/logic flaw that permits module takeover, but the exact root cause is not published (Oracle historically withholds technical detail in CPU advisories). No CPE strings were provided in the intelligence feed; affected-product identification relies on the Oracle/EUVD version string 'PeopleSoft Enterprise CS Student Records 9.2.38'.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships PeopleSoft fixes as CPU patches/PRPs against the 9.2 image rather than as a single tagged version, so no discrete fixed version string is published in the provided data - patch available per vendor advisory, exact fixed build to be confirmed from the Oracle CPU patch bundle for the 9.2.38 baseline. Because exploitation requires a low-privileged authenticated account, meaningful compensating controls until patching include: tightening PeopleSoft permission lists and roles so ordinary users cannot reach the Australian Features Student Records components (trade-off: may block legitimate Australian localization users); restricting network reachability of the PIA/WebLogic endpoints for this module to trusted campus networks or via VPN/WAF (trade-off: administrative overhead, no protection from already-authenticated insiders); and increasing monitoring/auditing of Student Records transactions for anomalous access. Deployments that do not use the Australian Features localization should confirm with Oracle whether the component can be disabled to remove exposure.