CVE-2026-60594: PeopleSoft Campus Community RCE Flaw

CVE-2026-60594 Overview

CVE-2026-60594 is a high-severity vulnerability in the Oracle PeopleSoft Enterprise CS Campus Community product, specifically in the Integration and Interfaces component. The affected version is 9.2.38. The flaw allows a low-privileged attacker with network access via HTTP to compromise the application. Successful exploitation results in complete takeover of PeopleSoft Enterprise CS Campus Community, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers with minimal privileges can remotely take over PeopleSoft Enterprise CS Campus Community deployments, exposing student and institutional data to full compromise.

Affected Products

Oracle PeopleSoft Enterprise CS Campus Community
Component: Integration and Interfaces
Version 9.2.38

Discovery Timeline

2026-07-21 - CVE CVE-2026-60594 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in Oracle Critical Patch Update

Technical Details for CVE-2026-60594

Vulnerability Analysis

The vulnerability resides in the Integration and Interfaces component of PeopleSoft Enterprise CS Campus Community 9.2.38. This component brokers data exchange between PeopleSoft modules and external systems over HTTP. Oracle classifies the issue as easily exploitable, requiring only low privileges and no user interaction. A successful attack yields high impact against confidentiality, integrity, and availability, meaning the attacker can read, modify, and disrupt data within the Campus Community module. Because Campus Community stores student records, biographic data, and institutional communications, exploitation exposes sensitive personally identifiable information (PII) and academic records.

Root Cause

Oracle has not published a detailed root cause analysis. The advisory indicates the flaw is reachable through the Integration and Interfaces subsystem, which processes HTTP-based integration messages. Vulnerabilities in this class typically arise from insufficient validation of authenticated user input in integration endpoints or improper access control on service handlers. Refer to the Oracle Critical Patch Update - July 2026 for authoritative details.

Attack Vector

The attack vector is network-based over HTTP. An authenticated attacker holding any valid low-privilege PeopleSoft account submits crafted requests to the Integration and Interfaces component. No user interaction is required, and the attack complexity is low. Because the scope is unchanged and impact is high across all three CIA properties, exploitation results in full module takeover within the vulnerable PeopleSoft instance.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60594

Indicators of Compromise

Unexpected HTTP POST requests to PeopleSoft Integration Broker endpoints from low-privileged user sessions
Anomalous integration message traffic outside of scheduled batch windows
New or modified service operations, routing definitions, or nodes in the Integration Broker configuration
Authentication events for low-privilege accounts followed by administrative-level data access within Campus Community

Detection Strategies

Review PeopleSoft application server and web server logs (PSAPPSRV, PIA) for suspicious Integration Broker request patterns
Correlate low-privilege user session activity with sensitive Campus Community record access
Baseline expected Integration and Interfaces traffic and alert on deviations in request volume or payload structure

Monitoring Recommendations

Forward PeopleSoft web, app, and audit logs into a centralized SIEM or data lake for correlation
Enable and retain Integration Broker monitoring (IB Monitor) transaction history for forensic review
Monitor privileged action audit tables (PSACCESSLOG, PSAUDIT) for entries tied to non-privileged operator IDs
Alert on modifications to PSIBOPRDFN (service operations) and node security configurations

How to Mitigate CVE-2026-60594

Immediate Actions Required

Apply the Oracle Critical Patch Update released July 2026 to all PeopleSoft Enterprise CS Campus Community 9.2.38 instances
Inventory PeopleSoft environments and confirm patch level via the PeopleTools maintenance log
Rotate credentials for any accounts with access to the Integration and Interfaces component
Restrict network exposure of PeopleSoft web servers to trusted networks and VPN users only

Patch Information

Oracle addressed CVE-2026-60594 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update Advisory - July 2026 for the specific patch identifier, prerequisites, and installation instructions applicable to PeopleSoft Enterprise CS Campus Community 9.2.38.

Workarounds

Limit access to Integration Broker service operations to a minimal set of trusted operator IDs and roles
Disable unused service operations and integration routings within Campus Community
Place PeopleSoft web servers behind a web application firewall (WAF) with rules restricting anomalous integration payloads
Enforce network segmentation so only authorized internal systems can reach the PeopleSoft Integration Broker endpoints

bash

# Example: restrict PeopleSoft PIA access at the network edge
# Allow only trusted subnets to reach the Integration Broker listener
iptables -A INPUT -p tcp --dport 8000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP