PeopleSoft Campus Community CVE-2026-60610

Exploitation requires network access over HTTPS to a PeopleSoft Enterprise CS Campus Community instance running version 9.2.38 specifically. The CVSS AC:H rating and Oracle's characterization of this as 'difficult to exploit' confirm that a high-complexity condition must be satisfied - the exact nature of this condition (such as a specific request structure, timing dependency, or application state) is not disclosed in the Oracle advisory or available references. No authentication is required (PR:N per CVSS vector), and no user interaction is needed once the complexity condition is met. Exploitation is strictly limited to confidentiality: integrity and availability of the system are unaffected. Organizations not running version 9.2.38 of the CS Campus Community module are not confirmed at risk from this specific advisory.

The CVSS 3.1 base score of 5.9 (Medium) encapsulates a meaningful tension: while the confidentiality impact is rated High - suggesting exposure of complete application data including student records and personally identifiable information that may be subject to FERPA protections in US contexts - the AC:H rating signals that exploitation requires specific conditions not met by routine or automated scanning. No EPSS score was provided in the source data, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The combination of AV:N and PR:N means a motivated attacker with network access and the ability to satisfy the high-complexity condition poses a genuine data exfiltration threat without needing credentials. The missing CWE identifier is a notable gap - it prevents root-cause comparison with similar historical authentication bypass patterns and limits defenders' ability to assess exploitability independently. The high-complexity requirement is the primary real-world limiter; however, determined adversaries targeting higher education institutions for sensitive student data should not discount this flaw.

An unauthenticated remote attacker sends a specially crafted HTTPS request to the exposed PeopleSoft CS Campus Community Security component, engineering the specific high-complexity condition required to trigger the authentication bypass. Once the bypass succeeds, the attacker reads sensitive institutional data - potentially including student PII, academic records, and financial aid details - without presenting valid credentials. The absence of public exploit code makes opportunistic mass exploitation unlikely; the more plausible threat is a targeted attacker who has performed prior reconnaissance on the specific application version and configuration.