What is the CVSS score of EUVD-2026-46952?

EUVD-2026-46952 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle PeopleSoft are affected by EUVD-2026-46952?

A high-severity vulnerability in Oracle PeopleSoft Enterprise Campus Community 9.2.38 allows low-privileged users to escalate privileges and fully compromise access to institutional data through the…

How to fix or mitigate EUVD-2026-46952?

Within 24 hours, inventory all Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 instances, immediately restrict network access to the Integration and Interfaces component to authorized administrative users only, and escalate to your security operations and infrastructure teams. Over the next 7 days, implement network segmentation to isolate the affected module, configure comprehensive access logging for all authentication and privilege escalation attempts, review all user accounts with low-privileged access to this component, and consider temporary suspension of non-critical Integration and Interfaces functionality. Within 30 days, establish a vendor patch monitoring process with Oracle, prepare and test an upgrade plan for immediate deployment when patches become available, and document all implemented compensating controls for compliance and audit purposes.

Oracle PeopleSoft EUVD-2026-46952

| CVE-2026-60594 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-jjx6-gh4x-5j3x

Authentication Bypass Oracle Peoplesoft Enterprise Campus Software Campus Community

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP vector with low complexity and no interaction, but a valid low-privileged account is required (PR:L); full module takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:28 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Integration and Interfaces). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CS Campus Community. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Integration and Interfaces component) lets a low-privileged, network-based attacker fully compromise the module over HTTP. The Oracle CPU July 2026 advisory rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, and Oracle labels it 'easily exploitable,' meaning any authenticated user can escalate to complete control of the application. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single required privilege make it a strong patching priority for higher-education and enterprise PeopleSoft deployments.

Technical ContextAI

PeopleSoft Enterprise Campus Community is Oracle's student-information module within the Campus Solutions (CS) suite, used by universities to manage constituent, biographic, and administrative records. The flaw resides in the Integration and Interfaces component, which handles the Integration Broker and messaging pathways that connect PeopleSoft to internal and external systems over HTTP/PIA (PeopleSoft Internet Architecture). Oracle publishes no CWE for this issue (CWE: N/A) and, per its standard CPU practice, withholds precise root-cause detail; the 'takeover' language combined with a low-privilege network vector is consistent with an authorization/access-control or injection weakness in the integration layer that lets an ordinary application user pivot to full module compromise. No CPE strings were provided in the input, so the affected surface is defined by Oracle's version statement rather than NVD CPE enumeration.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); this is the primary and vendor-sanctioned remediation. Oracle CPUs ship as cumulative patches/PeopleTools and application updates rather than a single tagged version, so no discrete fixed version number was provided in the input - obtain the specific patch mapped to Campus Community 9.2.38 from My Oracle Support and the CPU matrix (Patch available per vendor advisory). Until patched, reduce exposure by restricting network reachability of the PeopleSoft Internet Architecture and Integration Broker endpoints to trusted networks/VPN, tightening Integration Broker node and service-operation permissions, minimizing the population of low-privileged accounts, and enforcing MFA to limit who can reach the authenticated attack surface; note these controls can disrupt legitimate integrations and self-service access, so validate messaging flows after applying them.