CVE-2026-60605: PeopleSoft Student Records Disclosure Flaw

CVE-2026-60605 Overview

CVE-2026-60605 is an information disclosure vulnerability in the Oracle PeopleSoft Enterprise CS Student Records product. The flaw resides in the Higher Ed Statistics Agency - UK HESA component of version 9.2.38. An unauthenticated attacker with network access over HTTP can exploit the vulnerability to obtain unauthorized access to critical data. Successful exploitation can result in complete access to all data accessible through PeopleSoft Enterprise CS Student Records. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can read sensitive student records data without any user interaction, exposing personally identifiable information and academic records.

Affected Products

Oracle PeopleSoft Enterprise CS Student Records 9.2.38
Component: Higher Ed Statistics Agency - UK HESA
Deployments using HTTP-accessible PeopleSoft web interfaces

Discovery Timeline

2026-07-21 - CVE-2026-60605 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle Critical Patch Update released addressing the vulnerability

Technical Details for CVE-2026-60605

Vulnerability Analysis

The vulnerability affects the Higher Ed Statistics Agency (HESA) component within PeopleSoft Enterprise CS Student Records. Oracle classifies this as an easily exploitable flaw requiring no authentication and no user interaction. The impact is confined to confidentiality, with no integrity or availability effects. According to Oracle's advisory, successful attacks allow unauthorized access to critical data or complete access to all accessible Student Records data. The EPSS score of 0.398% reflects the current probability of observed exploitation activity.

Root Cause

Oracle has not publicly disclosed the underlying technical root cause. Based on the CVSS vector and impact profile, the flaw is consistent with an information disclosure weakness in the HESA integration component. The confidentiality-only impact suggests missing authorization checks or insufficient access control on data endpoints exposed by the module. No CWE identifier has been assigned in the NVD entry.

Attack Vector

The attack vector is network-based over HTTP. An attacker requires no credentials and no interaction from a legitimate user. Reaching the vulnerable component requires network access to the PeopleSoft web tier. Internet-exposed PeopleSoft instances face the highest risk, while segmented internal deployments limit the attack surface. Refer to the Oracle Critical Patch Update July 2026 advisory for exact affected endpoints.

Detection Methods for CVE-2026-60605

Indicators of Compromise

Unusual HTTP requests targeting HESA-related URLs or servlets within the PeopleSoft web tier
Unauthenticated requests returning large volumes of student data
Repeated access patterns from a single external IP against Student Records endpoints

Detection Strategies

Review PeopleSoft web server access logs for anonymous requests to HESA reporting endpoints
Correlate web tier logs with application server activity to identify data retrieval without an associated authenticated session
Deploy web application firewall rules to inspect and alert on unauthenticated access attempts against Student Records paths

Monitoring Recommendations

Enable verbose logging on the PeopleSoft Internet Architecture (PIA) web servers
Monitor for anomalous outbound response sizes from the Student Records module
Alert on HTTP 200 responses to requests lacking a valid PS_TOKEN session cookie for sensitive endpoints

How to Mitigate CVE-2026-60605

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to PeopleSoft Enterprise CS Student Records
Inventory all PeopleSoft deployments running version 9.2.38 with the HESA component enabled
Restrict network access to the PeopleSoft web tier to trusted networks and VPN users until patching is complete

Patch Information

Oracle released fixes for this vulnerability in the July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update July 2026 advisory for patch download links, prerequisite bundles, and installation guidance specific to PeopleSoft Enterprise CS Student Records 9.2.38.

Workarounds

Disable the Higher Ed Statistics Agency - UK HESA component if it is not required for operations
Place the PeopleSoft web tier behind an authenticating reverse proxy or WAF
Restrict inbound HTTP access to the affected endpoints using network ACLs until the patch is applied

bash

# Example: restrict PeopleSoft web tier access with iptables
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP