What is the CVSS score of EUVD-2026-46975?

EUVD-2026-46975 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.3%.

PeopleSoft Campus Community EUVD-2026-46975

| CVE-2026-60617 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4rf3-jwvw-gw8p

Authentication Bypass Oracle Peoplesoft Enterprise Cs Campus Community

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network HTTP attack path confirmed; AC:H per Oracle's 'difficult to exploit' designation; PR:N per authentication bypass tag and unauthenticated description; I:H for critical data write access, C:L for partial read, A:N as no availability impact described.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:01 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N).

AnalysisAI

Unauthenticated network-based authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 enables remote attackers to corrupt or destroy critical campus data and read a subset of accessible records via HTTP. The Security component flaw is tagged as an authentication bypass, with high integrity impact allowing unauthorized creation, deletion, and modification of critical data - a significant risk for higher education institutions relying on this system for student and community records. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle's July 2026 CPU confirms the vulnerability and a patch release.

Technical ContextAI

Oracle PeopleSoft Enterprise CS Campus Community is an Oracle-maintained higher education ERP module managing student lifecycle, financial aid, and community engagement data. The affected component is the Security subsystem of version 9.2.38. The vulnerability is tagged as an Authentication Bypass (CWE not formally assigned by NVD), meaning the Security component fails to properly enforce authentication gates for HTTP-accessible functionality. The CVSS vector AV:N/AC:H/PR:N/UI:N indicates the flaw is reachable without credentials over the network via HTTP, though exploitation requires meeting complex preconditions - likely specific request sequencing, timing, or a non-default but common configuration. No CPE string was provided; the affected product is confirmed as PeopleSoft Enterprise CS Campus Community version 9.2.38 per Oracle's advisory and the ENISA EUVD record (EUVD-2026-46975).

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number beyond the CPU release designation is not independently confirmed from the available data; consult Oracle support for the precise patch artifact targeting version 9.2.38. If immediate patching is not feasible, restrict network access to the PeopleSoft HTTP endpoint at the perimeter - specifically blocking unauthenticated external access to the Security component URLs using a web application firewall or reverse proxy ACL. Note that this workaround only reduces exposure from internet-facing deployments and does not protect against internal threat actors. Disabling the affected Security component entirely is likely not operationally feasible given its role in the product. Increase monitoring of authentication logs and data modification audit trails in Campus Community while the patch is being scheduled.