CVE-2026-60602: PeopleSoft Student Financials Auth Bypass

CVE-2026-60602 Overview

CVE-2026-60602 is a high-severity vulnerability in the Oracle PeopleSoft Enterprise CS Student Financials product, specifically within the Billing component. The affected version is 9.2.38. An authenticated attacker with low privileges can exploit this flaw over the network via HTTP to fully compromise the application. Successful exploitation results in complete takeover of PeopleSoft Enterprise CS Student Financials, impacting confidentiality, integrity, and availability. Oracle disclosed this issue in the July 2026 Critical Patch Update.

Critical Impact
A low-privileged network attacker can achieve full application takeover of PeopleSoft Enterprise CS Student Financials over HTTP without user interaction.

Affected Products

Oracle PeopleSoft Enterprise CS Student Financials version 9.2.38
Billing component of PeopleSoft Enterprise CS Student Financials
Deployments exposing the PeopleSoft web tier over HTTP/HTTPS

Discovery Timeline

2026-07-21 - CVE-2026-60602 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60602

Vulnerability Analysis

The vulnerability resides in the Billing component of PeopleSoft Enterprise CS Student Financials. An authenticated user with minimal privileges can send crafted HTTP requests to the affected component and compromise the application. The attack requires network access and low attack complexity, and no user interaction is needed. Successful exploitation grants the attacker the ability to read, modify, and disrupt data across the PeopleSoft Enterprise CS Student Financials instance.

Because Student Financials handles billing, tuition, and payment records, a compromise directly exposes financially sensitive student data. The scope remains unchanged, meaning the impact is confined to the vulnerable component, but the confidentiality, integrity, and availability impacts within that scope are each rated High.

Oracle has not published root cause details. The Oracle Critical Patch Update advisory is the authoritative reference. The EPSS probability is 0.447%, placing this CVE in the 36th percentile for likelihood of exploitation in the near term.

Root Cause

Oracle has not disclosed the underlying code-level root cause. Based on the attack characteristics — network-accessible HTTP endpoint, low privileges required, and full CIA impact — the flaw is consistent with an authenticated input handling issue in the Billing component that permits unauthorized actions or data access beyond the attacker's intended privilege level.

Attack Vector

The attack vector is network-based over HTTP. An attacker must hold valid credentials with low privileges on the PeopleSoft instance. The attacker sends crafted requests to the Billing component endpoints. No user interaction is required, and exploitation complexity is low. Refer to the Oracle Security Alert July 2026 for vendor-provided guidance.

No public proof-of-concept exploit code is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60602

Indicators of Compromise

Unexpected HTTP requests from low-privileged accounts targeting Billing component URLs within the PeopleSoft web tier
Anomalous modifications to billing, invoice, or student account records outside normal business workflows
Authentication events from service or student accounts followed by administrative-level data changes in Student Financials

Detection Strategies

Enable and forward PeopleSoft application server, web server, and database audit logs to a centralized analytics platform for correlation
Baseline normal Billing component request patterns and alert on deviations such as unusual parameter values or request frequencies
Monitor for privilege boundary violations where standard users access or modify records reserved for administrative roles

Monitoring Recommendations

Track failed and successful authentications against the PeopleSoft web tier for unusual source IP ranges
Alert on bulk export, modification, or deletion operations within Student Financials Billing tables
Continuously review Oracle Critical Patch Update advisories and correlate against installed PeopleSoft component versions

How to Mitigate CVE-2026-60602

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for PeopleSoft Enterprise CS Student Financials 9.2.38 immediately
Inventory all PeopleSoft instances and confirm the patch level of the Student Financials Billing component
Restrict network access to the PeopleSoft web tier to trusted networks and VPN users until patching is complete
Review and reduce standing low-privilege accounts that can reach the Billing component

Patch Information

Oracle addressed CVE-2026-60602 in the July 2026 Critical Patch Update. Administrators should download and apply the applicable patch bundle referenced in the Oracle Security Alert July 2026. Oracle strongly recommends applying Critical Patch Update fixes without delay, as unpatched systems remain exposed to authenticated network-based takeover.

Workarounds

Place the PeopleSoft web tier behind a web application firewall configured to block anomalous requests to Billing endpoints
Enforce network segmentation so that only authorized users and services can reach the Student Financials application
Rotate credentials for accounts with access to the Billing component and enforce multi-factor authentication where supported

bash

# Example: restrict access to PeopleSoft web tier at the network layer
# Allow only trusted subnets to reach the PeopleSoft HTTP port
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP