What is the CVSS score of CVE-2026-60614?

CVE-2026-60614 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-60614?

A high-severity vulnerability in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows authenticated users to manipulate or delete critical student and employee records and crash the system.

How to fix or mitigate CVE-2026-60614?

Within 24 hours, audit all systems running PeopleSoft 9.2.38 to identify which instances contain the Person Data component and document their criticality. Within 7 days, implement access controls restricting Person Data modification privileges to only essential administrators, enable detailed audit logging of all Person Data changes, and segment network access to limit which authenticated users can connect to PeopleSoft. Within 30 days, establish a vendor communication plan to obtain patch timeline information, evaluate upgrade paths to a patched version, and prepare a migration schedule to remediate this vulnerability.

Oracle PeopleSoft CVE-2026-60614

EUVD-2026-46972 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-xjgq-3mrv-jmh3

Authentication Bypass Oracle Peoplesoft Enterprise Campus Software Campus Community

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

vuln.today AI

7.1 HIGH

Network HTTP reachable but AC:H per Oracle's difficult-to-exploit wording, PR:L for the required low-privilege account, with high integrity/availability and limited confidentiality impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:23 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Person Data). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise CS Campus Community accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise CS Campus Community. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).

AnalysisAI

Data manipulation and denial-of-service in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Person Data component) lets a low-privileged, network-authenticated attacker create, delete or modify critical data, read a subset of accessible data, and trigger a repeatable crash of the module. The flaw carries a CVSS 3.1 base score of 7.1 and is flagged as difficult to exploit (AC:H). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

PeopleSoft Enterprise Campus Community is Oracle's student-information/constituent-management module within the PeopleSoft Campus Solutions (CS) ERP suite, used by universities to manage person, biographical and demographic records. The affected 'Person Data' component handles core identity records exposed over HTTP through the PeopleSoft Internet Architecture (PIA) web tier. Oracle's advisory does not assign a specific CWE (CWE: N/A), but the impact profile - unauthorized creation, deletion, modification and read of application data by an authenticated low-privilege user - is consistent with a broken access control / improper authorization class of weakness rather than memory corruption. The combined integrity and availability impact (I:H/A:H) suggests the flawed logic path also allows an attacker to drive the module into a hang or crash state.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though Oracle's CPU model does not publish a discrete fixed version string separate from the quarterly patch bundle, so track the CPU July 2026 PeopleSoft Campus Solutions bundle for 9.2.38. Because exploitation requires an authenticated low-privilege account, effective compensating controls until patching include restricting and reviewing user access to the Campus Community / Person Data pages, tightening PeopleSoft permission lists and roles that grant Person Data component access, and monitoring for anomalous create/delete/modify activity against person records; note these controls reduce but do not eliminate risk from legitimately low-privileged insiders. Where feasible, limit HTTP exposure of the PIA web tier to trusted networks/VPN to shrink the reachable attacker population, accepting the trade-off of reduced remote convenience for authorized users.