CVE-2026-60599: PeopleSoft Auth Bypass Vulnerability

CVE-2026-60599 Overview

CVE-2026-60599 is a high-severity vulnerability in the Oracle PeopleSoft Enterprise CS Student Records product, specifically within the Research Tracking component. The flaw affects supported version 9.2.38 and is exploitable by a low-privileged attacker with network access over HTTPS. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all PeopleSoft Enterprise CS Student Records data accessible to the application. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
An authenticated attacker with minimal privileges can compromise the confidentiality and integrity of all student records data accessible through the Research Tracking component.

Affected Products

Oracle PeopleSoft Enterprise CS Student Records 9.2.38
Component: Research Tracking
Access vector: Network (HTTPS)

Discovery Timeline

2026-07-21 - CVE-2026-60599 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the vulnerability in the Oracle Critical Patch Update

Technical Details for CVE-2026-60599

Vulnerability Analysis

The vulnerability resides in the Research Tracking component of PeopleSoft Enterprise CS Student Records. An attacker holding a valid low-privilege account can send crafted HTTPS requests to compromise data managed by the application. The flaw does not require user interaction and executes within the same security scope as the vulnerable component. Because the issue affects a broadly deployed higher-education platform, exploitation can expose sensitive student records at scale.

The EPSS probability is 0.365% with a percentile of 29.038, indicating current predictive scoring places this below high-likelihood exploitation candidates. No public proof-of-concept or exploitation activity is documented at the time of publication.

Root Cause

Oracle has not disclosed the underlying weakness class in public advisories. The vulnerability is categorized as a broken access control or improper authorization issue based on the impact profile: a low-privileged user can perform actions that should require higher privileges, including modifying and reading data outside their authorization scope. No CWE identifier has been assigned in the NVD entry.

Attack Vector

Exploitation requires network access to the PeopleSoft web interface over HTTPS and authentication as a low-privileged user. The attack does not require user interaction. Once authenticated, the attacker interacts with the Research Tracking component to trigger unauthorized data operations. The scope remains unchanged, meaning the attack affects resources managed by the vulnerable component itself.

No verified proof-of-concept code is publicly available. Refer to the Oracle Critical Patch Update advisory for authoritative technical context.

Detection Methods for CVE-2026-60599

Indicators of Compromise

Unexpected create, update, or delete operations on Research Tracking records performed by non-administrative accounts.
Anomalous HTTPS requests to PeopleSoft Research Tracking endpoints originating from user sessions with limited role assignments.
Bulk read operations against student records data by accounts that historically access only a small dataset.

Detection Strategies

Enable and review PeopleSoft audit logging (PSAUDIT, database-level audit tables) for the Research Tracking component to identify unauthorized data changes.
Correlate application-tier access logs with database query patterns to detect low-privileged accounts performing high-impact operations.
Establish behavioral baselines for privileged data access per user role and alert on deviations.

Monitoring Recommendations

Forward PeopleSoft web server, application server, and database audit logs to a centralized SIEM for correlation.
Monitor authentication logs for credential-stuffing or brute-force activity that could grant the low-privilege access required for exploitation.
Alert on any modifications to Research Tracking records made outside of documented business processes or maintenance windows.

How to Mitigate CVE-2026-60599

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected PeopleSoft Enterprise CS Student Records 9.2.38 deployments.
Inventory all PeopleSoft accounts and revoke access for inactive or unnecessary low-privilege users.
Restrict network exposure of the PeopleSoft application tier to trusted networks or VPN-only access where feasible.

Patch Information

Oracle published the fix in the July 2026 Critical Patch Update. Refer to the Oracle Critical Patch Update advisory for the specific patch identifiers, prerequisites, and installation instructions for PeopleSoft Enterprise CS Student Records 9.2.38.

Workarounds

Disable or restrict access to the Research Tracking component if it is not required for business operations until patching is complete.
Enforce multi-factor authentication on all PeopleSoft accounts to raise the barrier for obtaining the low-privileged access required for exploitation.
Place a web application firewall in front of the PeopleSoft web interface to inspect and rate-limit requests to Research Tracking URLs.

bash

# Example: restrict access at the network edge to the Research Tracking path
# (adjust hostnames, paths, and source ranges to match your environment)
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP