What is the CVSS score of CVE-2026-60611?

CVE-2026-60611 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

PeopleSoft Campus Community CVE-2026-60611

EUVD-2026-46969 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-2m6v-8g4p-879p

Information Disclosure Oracle Peoplesoft Enterprise Campus Software Campus Community

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable HTTP endpoint, no authentication or configuration required, impact strictly bounded to partial data read with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:02 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthenticated read access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows remote attackers to retrieve a subset of protected campus data via HTTP without credentials. The 'Authentication Bypass' tag indicates the Security component fails to enforce access controls on at least one network-accessible endpoint, exposing data - likely student records, enrollment data, or PII - to anonymous network queries. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle explicitly characterizes this as 'easily exploitable.'

Technical ContextAI

PeopleSoft Enterprise CS Campus Community is Oracle's higher-education ERP module, managing student lifecycle data including enrollment, financial aid, and campus services. The vulnerability resides in the 'Security' component - the layer responsible for authentication and authorization enforcement within the PeopleSoft application tier. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the flaw is reachable over HTTP with no prerequisites, consistent with an access-control bypass on a specific endpoint or API surface rather than a full authentication bypass of the login portal. No CWE is assigned in the source data, but the behavior aligns with CWE-284 (Improper Access Control) or CWE-862 (Missing Authorization). Only version 9.2.38 is confirmed affected per NVD and EUVD (EUVD-2026-46969) data.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available via the Oracle Security Alerts page at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version number is not independently confirmed in the available data - consult the full Oracle advisory for precise patch level details. As a compensating control prior to patching, restrict unauthenticated HTTP access to the PeopleSoft application tier at the network perimeter using firewall ACLs or a WAF, blocking external unauthenticated requests to the Security component's endpoints; note this may disrupt legitimate public-facing self-service functions if not scoped carefully. Additionally, review application access logs for anomalous unauthenticated HTTP requests to sensitive data paths to assess whether exploitation has already occurred.