What is the CVSS score of CVE-2026-60610?

CVE-2026-60610 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

PeopleSoft Campus Community CVE-2026-60610

EUVD-2026-46968 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-4cjr-282r-gg5q

Authentication Bypass Information Disclosure Oracle Peoplesoft Enterprise Campus Software Campus Community

5.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

AV:N and PR:N are consistent with the authentication bypass tag and HTTPS network vector; AC:H reflects Oracle's explicit 'difficult to exploit' characterization; C:H with I:N/A:N matches the data-disclosure-only impact described.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:03 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows unauthenticated network attackers via HTTPS to access critical or complete application data through an authentication bypass in the Security component. Disclosed as part of Oracle's Critical Patch Update for July 2026, the CVSS 3.1 score of 5.9 (Medium) reflects high attack complexity (AC:H), meaning exploitation requires specific non-trivial conditions. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Technical ContextAI

The affected product is Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38, an ERP platform used by higher education institutions to manage student enrollment, financial aid, academic records, and campus portal services. The vulnerability resides in the Security component and is tagged as an Authentication Bypass, suggesting the application fails to enforce authentication controls under specific high-complexity conditions accessible over HTTPS. No CWE identifier was assigned in the source data, limiting root-cause classification; however, the authentication bypass tag combined with the PR:N CVSS metric and confidentiality-only impact is consistent with weaknesses such as improper session validation, token forgery, or an access control check that can be bypassed under particular request conditions. The unchanged scope (S:U) confirms the impact is bounded within the Campus Community application itself.

RemediationAI

Oracle has released a patch for this vulnerability as part of the July 2026 Critical Patch Update; administrators should apply the relevant CPU patch immediately by consulting the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number beyond 'post-9.2.38 CPU fix' is not independently confirmed from the available data, so organizations should verify the specific patch identifier from the Oracle support portal. As compensating controls while patching, restrict HTTPS access to the PeopleSoft CS Campus Community application - particularly the Security component - to trusted institutional IP ranges via firewall ACLs or load balancer rules, noting this may impact legitimate remote students and staff. Additionally, enable enhanced authentication and access logging on the Security component to detect anomalous unauthenticated request patterns indicative of bypass attempts. Reducing internet-facing exposure of the application through network segmentation further reduces the attack surface for this network-vector flaw.