What is the CVSS score of CVE-2026-60607?

CVE-2026-60607 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

PeopleSoft Financial Aid CVE-2026-60607

EUVD-2026-46965 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-f5hv-9p6x-624m

Authentication Bypass Information Disclosure Oracle Peoplesoft Enterprise Cs Financial Aid

5.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local attack vector with low privileges required aligns with infrastructure logon prerequisite; C:H reflects complete financial aid data exposure; no integrity or availability impact identified.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:04 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Financial Aid product of Oracle PeopleSoft (component: FM Need Analysis Calculator). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise CS Financial Aid executes to compromise PeopleSoft Enterprise CS Financial Aid. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Financial Aid accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Local unauthorized data access in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 allows a low-privileged authenticated user with logon access to the hosting infrastructure to compromise the FM Need Analysis Calculator component and read critical or complete financial aid data. The Authentication Bypass tag from EUVD-2026-46965 suggests the component fails to enforce authorization boundaries for already-authenticated low-privilege accounts, enabling horizontal or vertical privilege escalation within the application. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at the time of analysis.

Technical ContextAI

Oracle PeopleSoft Enterprise CS Financial Aid is a higher-education ERP module used by colleges and universities to manage student financial aid processes, including need analysis, packaging, and compliance. The affected component, FM Need Analysis Calculator, performs financial need calculations that involve sensitive student financial data. The CVSS vector AV:L confirms the attack requires local infrastructure access rather than a network-facing attack surface. The tag 'Authentication Bypass' from EUVD suggests that a low-privileged principal (PR:L) can circumvent access controls within the application, likely due to missing or improperly enforced object-level or function-level authorization checks in the FM Need Analysis Calculator workflow. No CWE is formally assigned by NVD, but the symptom pattern aligns conceptually with CWE-285 (Improper Authorization) or CWE-862 (Missing Authorization). The affected version is specifically 9.2.38 of PeopleSoft Enterprise CS Financial Aid as confirmed by Oracle's July 2026 Critical Patch Update.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available via the Oracle Security Alerts page at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs are cumulative, so institutions should apply the full patch set rather than attempting selective patching. An exact patched version number was not independently stated in the available references beyond the July 2026 CPU designation - verify the specific patch ID with Oracle My Oracle Support. As a compensating control prior to patching, restrict logon access to the PeopleSoft infrastructure to only those accounts with a documented operational need, applying the principle of least privilege at the OS and PeopleSoft permission list level. Auditing PeopleSoft role assignments and reviewing access logs for the FM Need Analysis Calculator component can help detect unauthorized access attempts. Disabling the FM Need Analysis Calculator component entirely is an option only if the institution's financial aid workflow can tolerate the loss of that functionality, which is unlikely during active aid packaging cycles.