What is the CVSS score of CVE-2026-60613?

CVE-2026-60613 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

PeopleSoft Student Records CVE-2026-60613

EUVD-2026-46971 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-px93-hvch-c3r5

Authentication Bypass Oracle Peoplesoft Enterprise Campus Software Campus Community

6.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

High-privilege and high-complexity prerequisites are consistent with the description; network vector confirmed by HTTP attack path; full C/I/A impact matches stated takeover outcome.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:02 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CS Student Records. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full system takeover is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking component, exploitable over HTTP by a high-privileged network attacker under high-complexity conditions. Successful exploitation yields complete compromise of confidentiality, integrity, and availability - effectively granting an attacker control over the affected instance. No public exploit code exists and the vulnerability is not listed in CISA KEV; Oracle disclosed this through its Critical Patch Update for July 2026.

Technical ContextAI

PeopleSoft Enterprise Campus Solutions (CS) Student Records is Oracle's higher-education ERP module managing student enrollment, academic records, and research tracking workflows. The vulnerable component is the Research Tracking sub-module within version 9.2.38. No CWE identifier was assigned in the NVD entry, so the root-cause class is unconfirmed from available data; however, the combination of 'Information Disclosure' tagging and a full C:H/I:H/A:H impact profile suggests a logic or authorization flaw that may allow privilege escalation or data manipulation within the application tier. The attack surface is HTTP-based, consistent with PeopleSoft's PIA (PeopleSoft Internet Architecture) web layer.

RemediationAI

Apply the Oracle Critical Patch Update released in July 2026, available via the Oracle support portal and described in the advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number beyond 9.2.38 was not independently confirmed in the available data - consult My Oracle Support for the specific patch identifier and installation instructions. As a compensating control prior to patching, restrict access to the Research Tracking component by limiting the set of users holding high-privileged PeopleSoft roles that can access this module; this directly addresses the PR:H prerequisite and further reduces exploitability. Additionally, enable audit logging on privileged PeopleSoft accounts to detect anomalous access patterns. Note that role restriction may affect legitimate research administrators and should be coordinated with institutional stakeholders.