What is the CVSS score of CVE-2026-60605?

CVE-2026-60605 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of PeopleSoft Enterprise are affected by CVE-2026-60605?

Oracle PeopleSoft Enterprise CS Student Records 9.2.38 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access all student data within the module,…

How to fix or mitigate CVE-2026-60605?

Within 24 hours, identify and document all external-facing instances of PeopleSoft Enterprise CS Student Records 9.2.38 and their current network exposure, enable detailed access logging on the affected module, and assess whether active data exfiltration has occurred via log review. Within 7 days, implement network segmentation to restrict access to the Student Records module (allow only trusted internal networks and administrative access), deploy Web Application Firewall (WAF) rules to monitor and block suspicious data enumeration patterns, and enable IP-based access controls on the PeopleSoft application server. Within 30 days, establish a continuous monitoring regimen for Oracle security advisories regarding CVE-2026-60605, evaluate interim vendor workarounds if released, audit historical access logs to identify unauthorized queries, and assess migration timelines to patched versions or alternative student records systems if available.

PeopleSoft Enterprise CVE-2026-60605

EUVD-2026-46963 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-3qhc-gwx3-vjc7

Authentication Bypass Oracle Peoplesoft Enterprise Campus Software Campus Community

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote HTTP access with low complexity yields PR:N/AV:N/AC:L; impact is data disclosure only, so C:H with I:N and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:24 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Higher Ed Statistics Agency - UK HESA). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Student Records accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 (Higher Ed Statistics Agency - UK HESA component) lets a remote, unauthenticated attacker reach all data accessible to the Student Records module over HTTP. The flaw is easily exploitable per Oracle and, tagged as an authentication bypass, yields high confidentiality impact with no integrity or availability effect (CVSS 3.1 7.5). No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

PeopleSoft Enterprise Campus Solutions (CS) Student Records is Oracle's higher-education ERP module for managing student enrollment, grades, and academic records, deployed over the PeopleSoft Internet Architecture (PIA) - a web/application-server tier fronted by HTTP. The affected code is the Higher Ed Statistics Agency (UK HESA) component, which handles statutory reporting of student data to the UK's HESA body. Oracle assigns no CWE for this entry, but the vendor's 'Authentication Bypass' tag combined with a pure-confidentiality CVSS profile (C:H/I:N/A:N) points to a broken/missing access-control class of flaw (conceptually CWE-287/CWE-306-style) that exposes protected records to unauthenticated HTTP requests rather than memory corruption or injection.

RemediationAI

Apply the fixes in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the authoritative remediation for CVE-2026-60605; the input identifies 9.2.38 as affected but does not state an exact patched build, so treat the CPU-delivered patch/bundle for CS Student Records as the fix and confirm the target version from the advisory rather than an assumed number. Until the CPU is deployed, restrict network exposure of the Student Records / HESA functionality - place the PIA behind a VPN or IP allowlist, and use a WAF or reverse-proxy rule to block unauthenticated requests to the HESA reporting endpoints - accepting that this can disrupt legitimate remote or integration access to those pages. If the HESA reporting component is not in active use, disabling or unmapping that component reduces the attack surface with minimal operational impact for non-UK institutions.