CVE-2026-60604: PeopleSoft CS Campus Auth Bypass Flaw

CVE-2026-60604 Overview

CVE-2026-60604 is a high-severity vulnerability in the Security component of Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38. The flaw permits a low-privileged attacker with network access via HTTP to compromise the application. Successful exploitation results in full takeover of PeopleSoft Enterprise CS Campus Community, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update. The vulnerability requires authentication and is described as difficult to exploit, but the impact on all three security properties is high.

Critical Impact
Successful exploitation leads to complete takeover of PeopleSoft Enterprise CS Campus Community, exposing student records, financial data, and administrative functions to a low-privileged authenticated attacker.

Affected Products

Oracle PeopleSoft Enterprise CS Campus Community 9.2.38
Oracle PeopleSoft product family (Security component)
Deployments exposing the PeopleSoft HTTP interface to authenticated users

Discovery Timeline

2026-07-21 - CVE-2026-60604 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the Oracle Critical Patch Update Advisory

Technical Details for CVE-2026-60604

Vulnerability Analysis

The flaw resides in the Security component of PeopleSoft Enterprise CS Campus Community 9.2.38. Oracle classifies the issue as difficult to exploit, requiring specific runtime conditions or timing. An authenticated attacker with low privileges can escalate access and take over the application. The scope remains unchanged, meaning exploitation affects resources managed by the vulnerable component itself. Confidentiality, integrity, and availability impacts are all rated high, indicating that a successful attack yields full administrative control over Campus Community data and workflows.

Campus Community stores student demographic records, academic history, and identity attributes. A takeover therefore exposes personally identifiable information (PII) protected under FERPA and similar regulations. Oracle has not published component-level technical details, but the vector indicates the attack traverses the standard HTTP interface used by PeopleSoft PIA (Pure Internet Architecture) clients.

Root Cause

Oracle has not publicly disclosed the specific weakness class or CWE identifier for CVE-2026-60604. The advisory attributes the flaw to the Security component, suggesting an issue in authentication, authorization, or session handling logic rather than in an unauthenticated pre-auth path. See the Oracle Critical Patch Update - July 2026 for vendor guidance.

Attack Vector

An attacker requires network access to the PeopleSoft HTTP endpoint and a valid low-privileged account. The attacker then triggers the vulnerable Security component logic through crafted HTTP requests. No user interaction is required. Because attack complexity is high, exploitation likely depends on race conditions, state manipulation, or specific configuration prerequisites.

Oracle has not released proof-of-concept code. Refer to the vendor advisory for technical details.

Detection Methods for CVE-2026-60604

Indicators of Compromise

Unexpected privilege changes or role assignments in Campus Community security tables.
Anomalous HTTP requests to PeopleSoft PIA endpoints originating from low-privileged user sessions.
Session tokens reused from multiple source IP addresses within short time windows.
Unexplained access to student PII records outside normal business workflows.

Detection Strategies

Enable PeopleSoft audit logging for the Security component and forward events to a centralized SIEM.
Correlate authentication events with privilege-modification actions to surface unauthorized escalations.
Baseline normal HTTP request patterns per user role and alert on deviations targeting security endpoints.
Review database audit trails for PSOPRDEFN and role-related tables for unauthorized modifications.

Monitoring Recommendations

Ingest PeopleSoft application server logs, web server logs, and database audit logs into a unified analytics platform.
Alert on repeated failed authentication attempts followed by successful low-privilege logins from the same source.
Monitor outbound connections from PeopleSoft application servers for signs of data exfiltration.
Track configuration drift on PeopleSoft security definitions using file integrity monitoring.

How to Mitigate CVE-2026-60604

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for PeopleSoft Enterprise CS Campus Community immediately.
Inventory all PeopleSoft deployments and confirm which run version 9.2.38.
Rotate credentials for low-privileged accounts that access Campus Community after patching.
Restrict network access to PeopleSoft interfaces to trusted networks and VPN users only.

Patch Information

Oracle addressed CVE-2026-60604 in the July 2026 Critical Patch Update. Administrators must download and apply the Campus Community 9.2.38 security patch from My Oracle Support. Consult the Oracle Security Alert - July 2026 for the full patch matrix and installation prerequisites.

Workarounds

Limit HTTP access to the PeopleSoft PIA to authenticated corporate networks pending patch deployment.
Reduce the number of low-privileged accounts with access to Campus Community modules.
Enforce multi-factor authentication (MFA) on all PeopleSoft user accounts to raise the exploitation bar.
Enable enhanced audit logging on the Security component to accelerate incident response if compromise occurs.

bash

# Example: restrict PeopleSoft PIA access at the reverse proxy layer
# nginx snippet limiting access to trusted subnets
location /psp/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://peoplesoft-app-backend;
}