What is the CVSS score of CVE-2026-60616?

CVE-2026-60616 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

PeopleSoft Campus Community CVE-2026-60616

EUVD-2026-46974 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-jjqp-4mw4-c477

Authentication Bypass Oracle Peoplesoft Enterprise Campus Software Campus Community

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible HTTP vector with no auth required aligns with PR:N; AC:H reflects the vendor's 'difficult to exploit' characterization; no availability impact confirmed by description.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:01 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 exposes sensitive student and institutional data to unauthenticated remote attackers over HTTP. The Security component vulnerability allows a network-adjacent attacker to skip authentication controls and gain full read access to all Campus Community data, plus limited write access for inserts and deletes. No public exploit code exists and no CISA KEV listing has been observed, but the PR:N/C:H combination makes this a material confidentiality risk for higher education institutions running the affected version.

Technical ContextAI

Oracle PeopleSoft Enterprise CS Campus Community is a student information system widely deployed in universities and colleges for managing enrollment, financial aid, advising, and student records. The affected component is labeled 'Security,' and the tag 'Authentication Bypass' indicates a flaw in how the application validates or enforces session or identity checks over HTTP. The CVSS vector AV:N/PR:N confirms the attack surface is the web tier with no credential prerequisite. AC:H signals that exploitation is non-trivial - likely requiring precise timing, specific request crafting, or knowledge of internal application state. No CWE has been assigned, so the exact root-cause class (e.g., improper authentication, session fixation, access control bypass) is not formally categorized in NVD at time of analysis.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update, available via the Oracle CPU advisory at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability in PeopleSoft Enterprise CS Campus Community. A specific patched version number beyond the CPU release itself is not independently confirmed from available data - consult Oracle's My Oracle Support (MOS) for the exact patch ID and installation instructions. If immediate patching is not feasible, consider restricting access to the PeopleSoft web tier at the network perimeter (firewall or WAF rules) to limit exposure to trusted networks or VPN-connected users only, noting that this reduces accessibility for remote students and staff. Enabling enhanced web application firewall logging on the PeopleSoft HTTP endpoints can provide detection coverage while a patch window is scheduled. Given the Authentication Bypass nature, review PeopleSoft Security component audit logs for anomalous unauthenticated session activity as a compensating detective control.