PeopleSoft Campus Community CVE-2026-60616

Exploitation requires network access to the PeopleSoft Enterprise CS Campus Community web interface over HTTP, and no authentication credentials are needed (PR:N per CVSS vector). The attack complexity is high (AC:H), meaning exploitation is not straightforward and likely depends on specific application state, precise request sequencing, or knowledge of internal PeopleSoft routing - attackers cannot trivially automate mass exploitation. The vulnerability is confined to version 9.2.38 of the CS Campus Community module specifically; other PeopleSoft modules or versions are not identified as affected. Exploitation does not require user interaction. Limiting factors include: the AC:H barrier making reliable exploitation difficult, the need for HTTP network reachability to the PeopleSoft front end (often behind institutional VPNs or firewalls), and the scope being limited to Campus Community data (no lateral scope change to other systems).

The CVSS 6.5 score reflects a meaningful but not maximum-severity issue: AV:N and PR:N widen the attack surface considerably, but AC:H materially reduces exploitability, explaining why Oracle classifies this as 'difficult to exploit.' The Confidentiality impact is High (full data read) while Integrity is only Low (partial write), and Availability is unaffected. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation in the wild. The Authentication Bypass tag combined with a Security component location elevates concern beyond raw score - a successful attacker effectively impersonates an authorized user to the application layer. For institutions housing FERPA-regulated student records, the data sensitivity compounds the already significant confidentiality impact. Real-world exploitation likelihood is moderated by AC:H; this is not a drive-by attack, but targeted threat actors with institutional knowledge could execute it.

An attacker with network access to the institution's PeopleSoft web portal crafts a specially structured HTTP request targeting the Security component that exploits the authentication bypass, bypassing credential validation without possessing any account. Once authenticated as an arbitrary user or with elevated context, the attacker queries student records, financial aid data, or advising notes - data covered by FERPA - and potentially inserts or deletes records to disrupt institutional operations. No public proof-of-concept is confirmed at time of analysis, and the AC:H rating suggests this requires non-trivial request engineering.