PeopleSoft Campus Community CVE-2026-60611

No special conditions are required beyond network HTTP access to a PeopleSoft Enterprise CS Campus Community 9.2.38 instance - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated exploitation against the default application surface with no complexity requirements. Exploitation is bounded to version 9.2.38 specifically; other versions are not confirmed vulnerable. The impact is limited to reading a subset of accessible data - no write, delete, or availability impact is possible through this vector. The primary limiting factor for defenders is whether the PeopleSoft HTTP interface is exposed to untrusted networks; internally-hosted instances behind VPN or network segmentation significantly reduce realistic attacker reach despite the network attack vector.

The CVSS 3.1 base score of 5.3 (Medium) reflects limited confidentiality impact (C:L) with no integrity or availability consequences. However, the AV:N/AC:L/PR:N/UI:N vector means exploitation is trivially simple - any unauthenticated actor with HTTP reach to the application can attempt it. Oracle's own characterization of 'easily exploitable' reinforces low exploitation complexity. In higher-education environments, PeopleSoft instances often hold sensitive student PII, FERPA-protected records, and financial data, meaning even partial read access carries regulatory and reputational risk disproportionate to the medium CVSS score. No EPSS probability was provided, and the vulnerability is absent from CISA KEV, so confirmed active exploitation is unknown. The combination of zero authentication requirement and network accessibility makes this a realistic priority for internet-facing deployments, despite the score ceiling imposed by limited impact scope.

An unauthenticated external attacker identifies a PeopleSoft CS Campus Community 9.2.38 instance exposed over HTTP and sends a crafted request to an endpoint within the Security component that bypasses access control checks. The server returns a subset of campus community data - potentially student records, enrollment status, or identity fields - without requiring login. No public exploit code has been identified, but Oracle's 'easily exploitable' classification suggests the bypass requires minimal technical sophistication.