What is the CVSS score of CVE-2026-60604?

CVE-2026-60604 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-60604?

Within 24 hours, inventory all instances of Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 and implement network-layer restrictions to limit access to the Security component to essential administrative networks only. Within 7 days, obtain the Oracle July 2026 Critical Patch Update from Oracle support, validate it in a test environment replicating production configuration, and schedule a maintenance window for controlled deployment. Within 30 days, deploy the patch to all production systems, verify that the vulnerability is remediated through post-patch testing, and review Security component logs for unauthorized access attempts during the interim period.

Peoplesoft Enterprise Campus Software Campus Community CVE-2026-60604

EUVD-2026-46962 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-j59v-gpjr-p84v

Authentication Bypass Oracle Peoplesoft Enterprise Campus Software Campus Community

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:25 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CS Campus Community. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 is possible for a low-privileged attacker with network (HTTP) access to the Security component, resulting in high confidentiality, integrity and availability impact. Oracle rates this CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H), and it requires an authenticated (low-privilege) session. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.