CVE-2026-60603: Oracle PeopleSoft RCE Vulnerability

CVE-2026-60603 Overview

CVE-2026-60603 is a network-exploitable vulnerability in the Oracle PeopleSoft Enterprise Campus Solutions (CS) Student Records product, specifically within the Australian Features component. The flaw affects version 9.2.38 and allows a low-privileged attacker with HTTP access to fully compromise the Student Records module. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation results in complete takeover of PeopleSoft Enterprise CS Student Records, impacting confidentiality, integrity, and availability of student data.

Affected Products

Oracle PeopleSoft Enterprise CS Student Records 9.2.38
Component: Australian Features
Deployments exposing PeopleSoft HTTP endpoints to authenticated users

Discovery Timeline

2026-07-21 - CVE-2026-60603 published to NVD via Oracle Critical Patch Update July 2026
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60603

Vulnerability Analysis

The vulnerability resides in the Australian Features component of PeopleSoft Enterprise CS Student Records. Oracle categorizes the issue as easily exploitable and reachable over the network via HTTP. An attacker requires only low privileges, meaning any authenticated user with basic access to the PeopleSoft web interface can attempt exploitation. No user interaction is required.

Successful exploitation yields high impact across all three security properties. Attackers can read protected student records, modify academic data, and disrupt availability of the module. The scope remains unchanged, indicating the compromise is contained within the vulnerable component's security authority.

Oracle has not published detailed technical root-cause information, which is standard practice for Critical Patch Update advisories. Historically, PeopleSoft flaws in region-specific feature modules have involved improper access control, injection through unsanitized parameters, or authorization bypasses in business logic paths.

Root Cause

Oracle's advisory does not disclose the underlying weakness class. Given the low-privilege network vector and complete takeover outcome, the flaw likely stems from insufficient input validation or missing authorization checks in an HTTP-accessible handler within the Australian Features codebase.

Attack Vector

An attacker sends crafted HTTP requests to a PeopleSoft endpoint tied to the Australian Features component. The attacker must hold a valid low-privilege session. No social engineering or victim interaction is required. Refer to the Oracle Critical Patch Update July 2026 for authoritative remediation guidance.

No verified proof-of-concept code is publicly available for CVE-2026-60603.
Oracle Critical Patch Update advisories do not include exploitation details.

Detection Methods for CVE-2026-60603

Indicators of Compromise

Unexpected HTTP requests to PeopleSoft CS Student Records URLs referencing Australian Features components from low-privilege user sessions
Anomalous access patterns to student record tables outside normal business hours or from unusual source IPs
New or modified administrative accounts within the PeopleSoft environment following suspicious activity

Detection Strategies

Enable PeopleSoft application server audit logging and forward events to a centralized SIEM for correlation
Baseline normal HTTP request patterns to the CS Student Records module and alert on deviations by low-privilege accounts
Monitor database query logs for unauthorized reads or writes against student records tables originating from the Australian Features workflow

Monitoring Recommendations

Track failed and successful authentication events tied to CS Student Records endpoints
Alert on privilege changes, role additions, or configuration edits within PeopleSoft security administration
Correlate web server access logs with application-layer user context to identify low-privilege accounts accessing sensitive functionality

How to Mitigate CVE-2026-60603

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all PeopleSoft Enterprise CS Student Records deployments running version 9.2.38
Inventory PeopleSoft instances and confirm whether the Australian Features component is enabled
Restrict network access to PeopleSoft HTTP endpoints to trusted networks and authenticated users only
Review recent audit logs for signs of exploitation before patching

Patch Information

Oracle addressed CVE-2026-60603 in the July 2026 Critical Patch Update. Administrators should download the applicable patch bundle from My Oracle Support and apply it in accordance with Oracle's published change management guidance. See the Oracle Critical Patch Update July 2026 advisory for patch identifiers and installation prerequisites.

Workarounds

If patching cannot be completed immediately, restrict access to the Australian Features component through PeopleSoft permission lists and roles
Place a web application firewall in front of PeopleSoft to filter suspicious HTTP requests targeting Student Records endpoints
Reduce the population of low-privilege accounts with network access to the affected module until the patch is applied

bash

# Example: restrict PeopleSoft HTTP access at the network layer
# Allow only trusted subnets to reach the PeopleSoft web server
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP