What is the CVSS score of CVE-2026-60615?

CVE-2026-60615 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-60615?

Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 contains an unauthenticated authentication bypass in the Security component that allows remote attackers to read all accessible module data…

How to fix or mitigate CVE-2026-60615?

Within 24 hours: Inventory all systems running PeopleSoft 9.2.38 and immediately restrict the affected Security component to internal networks only, preventing public internet access. Within 7 days: Deploy Web Application Firewall (WAF) rules to enforce authentication on all Security component endpoints; implement IP whitelisting for legitimate users; enable enhanced logging on the affected module. Within 30 days: Contact Oracle support to confirm upgrade compatibility and timeline; plan migration to a patched version or evaluated alternative solution; implement ongoing access monitoring and data exfiltration detection.

Oracle PeopleSoft CVE-2026-60615

EUVD-2026-46973 HIGH

Improper Authentication (CWE-287)

2026-07-21 secalert_us@oracle.com

GHSA-j6rv-g746-j846

Authentication Bypass Oracle Peoplesoft Enterprise Campus Software Campus Community

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Unauthenticated network HTTP access with low complexity (AV:N/AC:L/PR:N/UI:N) yields full data read (C:H) and partial write (I:L) with no availability impact, matching the authentication-bypass behavior.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:23 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Unauthenticated data compromise in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) lets remote attackers reach the application over HTTP and read all data the module can access, with limited unauthorized insert/update/delete on some data. Vendor and community tags flag this as an authentication bypass, aligning with the PR:N (no privileges) CVSS vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' with a CVSS 3.1 base score of 8.2.

Technical ContextAI

PeopleSoft Campus Community is the module of Oracle's PeopleSoft Campus Solutions ERP suite that manages student/constituent bio-demographic data, relationships, communications, and checklists for higher-education institutions. The affected 'Security' component governs authentication and authorization enforcement across the web-facing PIA (PeopleSoft Internet Architecture) tier. The 'Authentication Bypass' tag and the CVSS profile (AV:N/PR:N with high confidentiality and low integrity impact) point to a flaw allowing a request to bypass access-control checks and reach protected data without valid credentials. Oracle published no CWE (listed as N/A), so the precise root-cause class is not formally classified, but the behavior is consistent with broken authentication/improper access control (CWE-287/CWE-284 family).

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory) referenced at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle CPUs bundle the Campus Solutions/Campus Community patch sets, and administrators should identify and apply the specific patch for CS Campus Community 9.2.38 from that advisory. No exact fixed version string is provided in the input, so confirm the target patch level via My Oracle Support before deployment. As compensating controls until patched, restrict network access to the PeopleSoft Internet Architecture (PIA) web tier so it is not directly internet-facing - place it behind a VPN or reverse proxy with strict allow-listing, which limits reachability but may disrupt external student/self-service access; add WAF rules in front of the PIA to detect and block anomalous unauthenticated requests to Campus Community endpoints, accepting possible false positives against legitimate traffic; and closely monitor web-server and application logs for unauthenticated access to Campus Community pages.