What is the CVSS score of CVE-2026-61103?

CVE-2026-61103 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

PeopleSoft Campus Community CVE-2026-61103

EUVD-2026-47314 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-8xg5-27v2-5c9m

Authentication Bypass Information Disclosure Oracle Peoplesoft Enterprise Cs Campus Community

5.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.9 MEDIUM

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

5.9 MEDIUM

Adjacent vector confirmed by physical-segment access requirement; AC:H reflects Oracle's 'difficult to exploit' rating; no availability impact per description.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:23 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise CS Campus Community executes to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) enables an unauthenticated attacker positioned on the adjacent physical network segment to access critical application data and manipulate select records. The exploit is rated difficult due to adjacent-network positioning requirements and high attack complexity, yielding a moderate CVSS 5.9 score despite the high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, limiting immediate mass-exploitation risk.

Technical ContextAI

The affected component is the Security subsystem of PeopleSoft Enterprise CS Campus Community version 9.2.38, a higher-education student information and campus administration platform published by Oracle. The CVSS vector AV:A indicates the attacker must occupy the same physical or logical network segment as the PeopleSoft application host - not a remote internet-based attack. The tag 'Authentication Bypass' suggests the root cause lies in a flaw within the Security component's authentication or session-handling logic that can be exploited by an attacker able to intercept or inject into adjacent network communications, possibly through a man-in-the-middle or credential interception technique. No CWE identifier was provided in the advisory, so the precise root-cause class (e.g., CWE-287 Improper Authentication or CWE-294 Authentication Bypass by Capture-replay) cannot be confirmed from available data. The CPE-equivalent scope is PeopleSoft Enterprise CS Campus Community 9.2.38.

RemediationAI

Apply the Oracle Critical Patch Update released July 2026, which addresses CVE-2026-61103 for PeopleSoft Enterprise CS Campus Community. The advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html - consult it for the specific patch bundle or updated version that supersedes 9.2.38. Because no exact post-patch version number is confirmed in the available intelligence, organizations should verify the precise updated build with Oracle support before deployment. As a compensating control while patching, restrict network-level access to the PeopleSoft application hosts by enforcing 802.1X port authentication or VLAN segmentation to prevent unauthorized devices from joining the adjacent network segment - this directly mitigates the AV:A attack vector. Additionally, review PeopleSoft Security component configuration and enable enhanced audit logging for authentication events to detect bypass attempts. These controls carry no functional side effects for legitimate campus users accessing PeopleSoft through standard client paths.