PeopleSoft Campus Community CVE-2026-60609

Exploitation requires a valid authenticated session with at least low-privilege credentials on the PeopleSoft system (PR:L per the Oracle-supplied CVSS vector) and HTTPS network access to the Communication component. The specific affected version is 9.2.38 - other versions are not listed as affected. No user interaction from a victim is required (UI:N). The primary limiting factor is the need for at least a basic authenticated account; fully unauthenticated external attackers cannot directly exploit this flaw. The 'Authentication Bypass' tag indicates the bypass targets authorization enforcement within an authenticated session rather than the login mechanism itself - the attacker must hold a valid account but can then access data outside their authorized scope. Organizations with strict network perimeter controls that prevent external HTTPS access to PeopleSoft reduce exposure to credential-theft scenarios, but insider threats or compromised accounts retain full exploitation capability.

The CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects a network-reachable, low-complexity flaw requiring only low-privilege credentials, with complete confidentiality impact and no integrity or availability consequences. The real-world priority for institutions running PeopleSoft 9.2.38 is higher than the medium score suggests: student PII, financial aid records, and academic transcripts represent high-value targets subject to FERPA and other education privacy regulations. No EPSS score is available in the provided data, preventing quantitative exploitation probability comparison. No CISA KEV listing exists and no public exploit has been identified, reducing immediate automated exploitation risk. The 'Authentication Bypass' tag introduces a nuance - if the flaw is easier to exploit than PR:L implies (e.g., bypassing session validation rather than just authorization), the risk profile could shift upward. This should be treated as a priority for any institution on version 9.2.38 given the sensitivity of campus community data and the low exploitation complexity once credentials are obtained.

An attacker who has obtained or possesses a low-privileged PeopleSoft account - such as a student, contractor, or compromised staff credential - sends crafted HTTPS requests to the Communication component of PeopleSoft Enterprise CS Campus Community 9.2.38. By exploiting the authorization bypass, the attacker retrieves sensitive records beyond their permitted scope, potentially including academic transcripts, financial aid data, student PII, or administrative correspondence belonging to other users. No public exploit code has been identified at time of analysis, but the low attack complexity means this requires only basic web application skills and knowledge of the PeopleSoft API or communication endpoints.