Peoplesoft Enterprise Campus Software Campus Community CVE-2026-60604

A critical authentication vulnerability in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows low-privilege internal users to gain unauthorized administrative control over the entire system, exposing sensitive institutional data and business operations to compromise. Organizations running affected versions face potential exposure of student and employee records, unauthorized access to payroll and financial data, and complete operational disruption. This represents a high-severity insider-threat vulnerability requiring urgent technical response and access controls.

Within 24 hours, inventory all instances of Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 and implement network-layer restrictions to limit access to the Security component to essential administrative networks only. Within 7 days, obtain the Oracle July 2026 Critical Patch Update from Oracle support, validate it in a test environment replicating production configuration, and schedule a maintenance window for controlled deployment. Within 30 days, deploy the patch to all production systems, verify that the vulnerability is remediated through post-patch testing, and review Security component logs for unauthorized access attempts during the interim period.

No vendor-released patch identified at time of analysis; fix will be included in Oracle July 2026 Critical Patch Update. Pending patch deployment, implement interim controls: restrict network access to PeopleSoft Security component to authorized administrative IP ranges only; enforce multi-factor authentication for all Security component access; implement enhanced logging and real-time alerting on all authentication attempts and privilege escalation events; conduct daily review of Security component access logs for anomalies; consider temporarily disabling non-critical Security component features if operationally feasible.