PeopleSoft Student Records CVE-2026-60613

Exploitation requires the attacker to already hold a high-privileged account within the PeopleSoft Enterprise CS environment (PR:H), meaning administrative or elevated application-tier credentials are a hard prerequisite. Beyond authentication, the attack has high complexity (AC:H), indicating that exploitation is not straightforward even for a privileged user - specific application state, timing, or non-default conditions within the Research Tracking component must align. The vulnerability is limited to version 9.2.38 of PeopleSoft Enterprise CS Student Records and is accessed via HTTP, implying the PeopleSoft web tier must be network-reachable to the attacker. Scope is unchanged (S:U), so impact is contained to the PeopleSoft instance itself. Limiting factors: exploitation requires pre-existing high-privileged credentials, high attack complexity conditions, and targeting a specific version of a higher-education ERP product.

The Oracle-assigned CVSS 3.1 base score of 6.6 (Medium) reflects the significant exploitation barriers: AC:H indicates that the attack requires conditions beyond the attacker's control (such as a race condition, specific application state, or precise timing), and PR:H mandates that the attacker already holds a highly privileged account within the PeopleSoft environment. Despite a high-impact triad (C:H/I:H/A:H), these prerequisites substantially constrain real-world exploitability. No EPSS data was provided in the source intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no public proof-of-concept has been identified, further deprioritizing emergency response relative to externally accessible, low-complexity flaws. The 'Information Disclosure' tag appears inconsistent with the full C/I/A impact described - the actual vulnerability class may be broader than information disclosure alone; defenders should not scope response based on the tag alone. Real-world risk is assessed as low-to-moderate: highest for institutions where privileged PeopleSoft accounts are broadly distributed or where administrative credentials may be compromised.

An attacker with high-privileged access to a PeopleSoft CS 9.2.38 instance - such as a compromised administrator credential or an insider threat - sends a crafted HTTP request to the Research Tracking component under specific application-state conditions (AC:H). If the conditions are met, the attacker achieves full control over the PeopleSoft instance, potentially accessing or manipulating student academic records and research data. No public exploit code is available, making opportunistic exploitation unlikely; targeted exploitation by an authenticated insider or via credential theft is the more realistic threat model.