CVE-2026-60598: PeopleSoft Auth Bypass Vulnerability

CVE-2026-60598 Overview

CVE-2026-60598 is a vulnerability in the Oracle PeopleSoft Enterprise CS Student Records product, specifically within the Research Tracking component. The affected version is PeopleSoft 9.2.38. A low-privileged attacker with network access via HTTP can exploit this vulnerability, though the exploitation is difficult to achieve. Successful exploitation results in a full takeover of PeopleSoft Enterprise CS Student Records, impacting confidentiality, integrity, and availability. Oracle addressed this issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation leads to complete compromise of PeopleSoft Enterprise CS Student Records, exposing student data and enabling unauthorized modification of academic records.

Affected Products

Oracle PeopleSoft Enterprise CS Student Records 9.2.38
Component: Research Tracking
Deployments accessible via HTTP network protocol

Discovery Timeline

2026-07-21 - CVE CVE-2026-60598 published to NVD
2026-07-21 - Oracle discloses vulnerability in July 2026 Critical Patch Update
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60598

Vulnerability Analysis

The vulnerability resides in the Research Tracking component of Oracle PeopleSoft Enterprise CS Student Records 9.2.38. An authenticated attacker with low privileges and network access via HTTP can compromise the application. While Oracle classifies the exploitation as difficult, successful attacks result in complete takeover of the Student Records module. This module stores academic history, research data, enrollment information, and other sensitive student records. Compromise of this component affects confidentiality, integrity, and availability of institutional records.

Root Cause

Oracle has not publicly disclosed the specific root cause. The advisory indicates that authenticated network access is required and that exploitation requires overcoming additional preconditions, consistent with a complex attack pattern. Referenced in the Oracle Security Alert July 2026, the flaw permits privilege escalation from a low-privileged application account to full control of the Research Tracking subsystem.

Attack Vector

The attack vector is network-based over HTTP. The attacker must hold a valid low-privileged PeopleSoft account before attempting exploitation. No user interaction is required. Because Student Records systems are frequently exposed to campus networks and partner integrations, attackers with student, staff, or contractor credentials represent the realistic threat population. The current EPSS probability is 0.345%, indicating limited near-term exploitation likelihood, and no public proof-of-concept exists.

// No verified public proof-of-concept code is available for CVE-2026-60598.
// Refer to the Oracle Critical Patch Update July 2026 advisory for technical details.

Detection Methods for CVE-2026-60598

Indicators of Compromise

Unexpected authentication events from low-privileged PeopleSoft accounts accessing Research Tracking URLs
Unusual HTTP POST or PUT requests to Research Tracking endpoints outside normal business workflows
Creation or modification of administrative roles by non-administrative accounts within PeopleSoft
Anomalous data export volumes from the CS Student Records module

Detection Strategies

Enable PeopleSoft application-level auditing on the Research Tracking component and forward logs to a centralized SIEM
Baseline HTTP request patterns per user role and alert on deviations targeting Student Records endpoints
Correlate PeopleSoft application logs with web server access logs to identify multi-stage exploitation attempts

Monitoring Recommendations

Monitor PeopleSoft user role changes and permission escalations in real time
Track outbound data flows from PeopleSoft database servers for unusual volumes or destinations
Alert on failed then successful authentication sequences that precede Research Tracking access

How to Mitigate CVE-2026-60598

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all PeopleSoft Enterprise CS Student Records 9.2.38 instances
Inventory all PeopleSoft accounts with access to the Research Tracking component and remove unnecessary entitlements
Restrict HTTP access to PeopleSoft Student Records interfaces using network segmentation and VPN requirements
Rotate credentials for any accounts flagged during log review

Patch Information

Oracle released the fix in the July 2026 Critical Patch Update. Administrators should review the Oracle Security Alert July 2026 for the specific patch bundle applicable to their PeopleSoft deployment. Apply patches in a test environment before production rollout to validate application functionality.

Workarounds

Restrict access to the Research Tracking component to a minimum set of authenticated users through PeopleSoft permission lists
Place PeopleSoft web servers behind a web application firewall configured to inspect and rate-limit HTTP traffic to Student Records URLs
Enforce multi-factor authentication for all PeopleSoft accounts to raise the barrier for credentialed attackers

bash

# Example: restrict Research Tracking access via PeopleSoft permission list review
# Review current permission list assignments in PeopleSoft
# Navigation: PeopleTools > Security > Permissions & Roles > Permission Lists
# Remove non-essential access to Research Tracking pages and components
# Enforce IP allow-listing at the web tier for Student Records URLs