What is the CVSS score of CVE-2026-60609?

CVE-2026-60609 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

PeopleSoft Campus Community CVE-2026-60609

EUVD-2026-46967 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-hv2x-4fv4-67p8

Authentication Bypass Information Disclosure Oracle Peoplesoft Enterprise Campus Software Campus Community

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network access via HTTPS with low-privilege auth required; pure confidentiality impact, no integrity or availability consequences, no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:03 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Communication). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows a low-privileged authenticated attacker to read all data accessible within the system via HTTPS against the Communication component. Tagged as an Authentication Bypass by EUVD intelligence, the flaw appears to operate at the authorization layer - an attacker with a valid low-privilege session can exceed their permitted data scope rather than bypass authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a credible insider or credential-theft-follow-on threat for higher education environments.

Technical ContextAI

PeopleSoft Enterprise CS Campus Community is Oracle's higher-education Student Information System (SIS), handling student records, correspondence, financial aid data, academic transcripts, and campus-wide communication workflows. The vulnerable component is 'Communication,' which manages messaging and data exchange between institutional stakeholders. The EUVD tags this as an Authentication Bypass, which in the context of PR:L (low privilege required per CVSS) most likely indicates an authorization control flaw - the system fails to properly enforce role-based or object-level access restrictions within the Communication component, allowing a legitimately authenticated low-privilege user to read data beyond their permitted scope. No CWE is assigned by Oracle, limiting formal root-cause classification, but the pattern maps broadly to CWE-285 (Improper Authorization) or CWE-639 (Authorization Bypass Through User-Controlled Key). Affected version is 9.2.38, accessed over HTTPS.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability in PeopleSoft Enterprise CS Campus Community 9.2.38. The exact patched version number is not independently confirmed from the available advisory data - consult Oracle My Oracle Support (MOS) to verify the precise patch level required. As a compensating control pending patching, restrict HTTPS access to the PeopleSoft Communication component to authorized internal network segments only, blocking external or untrusted network exposure; note this will impact legitimate remote users. Additionally, audit and enforce the principle of least privilege on all PeopleSoft user accounts, removing unnecessary roles that could be leveraged post-exploitation. Monitor PeopleSoft access logs for anomalous cross-user data queries in the Communication component.