PeopleSoft Enterprise CVE-2026-60605

Exploitation requires that the target run PeopleSoft Enterprise CS Student Records 9.2.38 with the Higher Ed Statistics Agency (UK HESA) component deployed and its HTTP interface (PeopleSoft Internet Architecture) reachable by the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no authentication, privilege, or user-interaction prerequisites - an unauthenticated remote attacker can trigger it against a default-reachable instance. The primary limiting factor is scope of deployment: only sites running this specific version and the UK-HESA component are exposed, which in practice narrows targets to UK higher-education institutions and any organization exposing that component to untrusted networks; instances kept behind VPN/IP restrictions are correspondingly harder to reach.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes the most exploitation-friendly profile: network reachable, low complexity, no privileges, and no user interaction, which is why Oracle rates it 'easily exploitable' and scores it 7.5. Impact is bounded to confidentiality only - no data modification or service disruption - so this is a data-breach risk, not an RCE or integrity risk. Countervailing signals lower the immediacy: there is no public exploit, no CISA KEV listing, and no EPSS score supplied, so exploitation is currently theoretical rather than observed. On balance this is a genuine priority for organizations running the exact affected module (UK higher-education institutions handling HESA reporting) given the trivial exploitation and sensitive student PII exposed, but a lower priority for the broad PeopleSoft install base that does not deploy the HESA component. No conflicting signals were found in the provided data; the main gap is the absence of EPSS and any independent exploit intelligence.

An attacker who can reach the PeopleSoft PIA over HTTP sends crafted unauthenticated requests to the UK HESA Student Records functionality and, exploiting the authentication-bypass weakness, retrieves student records without any credentials. Because no user interaction or privileges are required and complexity is low, the attacker can script bulk extraction of sensitive academic and personal data. No public proof-of-concept is currently identified, so exploitation would require the attacker to independently develop the request sequence.