CVE-2026-60609: Oracle PeopleSoft Information Disclosure

CVE-2026-60609 Overview

CVE-2026-60609 is an information disclosure vulnerability in the Oracle PeopleSoft Enterprise CS Campus Community product, specifically within the Communication component. The affected release is version 9.2.38. A low-privileged attacker with network access over HTTPS can exploit the flaw to gain unauthorized read access to sensitive Campus Community data. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation allows an authenticated attacker to obtain unauthorized access to critical data or complete access to all data accessible through PeopleSoft Enterprise CS Campus Community.

Affected Products

Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38
Component: Communication
Vendor: Oracle

Discovery Timeline

2026-07-21 - CVE-2026-60609 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle Critical Patch Update

Technical Details for CVE-2026-60609

Vulnerability Analysis

The vulnerability affects the Communication component of PeopleSoft Enterprise CS Campus Community, a module used by higher education institutions to manage student, faculty, and constituent communications. An attacker who has authenticated to the application with low-level privileges can send crafted HTTPS requests that return data the account should not be permitted to view.

Exploitation does not require user interaction or elevated privileges. Attack complexity is low, and the attack scope is unchanged. Only confidentiality is impacted; integrity and availability of the application remain unaffected. The Exploit Prediction Scoring System (EPSS) currently places CVE-2026-60609 at the 28th percentile, indicating a low near-term likelihood of observed exploitation.

Root Cause

Oracle has not published the underlying code-level root cause. Based on the CVSS metrics and the affected component, the flaw is consistent with a broken access control or authorization check within the Communication module, allowing a low-privileged user to read records outside their assigned permission scope. Oracle categorizes the impact as unauthorized access to critical data, aligning with an authorization or data-exposure defect [CWE-284 / CWE-863 class].

Attack Vector

An authenticated attacker with any valid low-privilege PeopleSoft account establishes an HTTPS session to the Campus Community application. The attacker then issues requests to the Communication component that bypass expected access checks, returning data belonging to other users or restricted records. Network exposure of the PeopleSoft web tier to untrusted users significantly increases the attackable population, since any low-tier account is sufficient.

No public proof-of-concept or exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Oracle Critical Patch Update advisory for vendor-supplied technical guidance.

Detection Methods for CVE-2026-60609

Indicators of Compromise

Anomalous volumes of HTTPS requests to Campus Community Communication endpoints from a single low-privileged PeopleSoft account.
Access to Campus Community records outside a user's assigned role, institution, or student population.
Unusual data export activity or repeated queries returning large result sets for accounts that historically issue few queries.

Detection Strategies

Enable PeopleSoft application server and web server access logging, and forward authenticated request logs to a centralized SIEM for correlation.
Baseline normal Campus Community access patterns per user role and alert on statistical deviations in record retrieval volume or scope.
Review PeopleSoft audit tables (PSACCESSLOG, record-level auditing) for cross-population reads by low-privileged operator IDs.

Monitoring Recommendations

Monitor authentication logs for newly created or dormant low-privilege operator IDs that begin issuing Communication component requests.
Alert on HTTPS traffic to Campus Community URLs originating from unexpected source networks or geographies.
Track the deployment status of the July 2026 Oracle CPU across all PeopleSoft environments and flag hosts that remain on version 9.2.38 without the patch applied.

How to Mitigate CVE-2026-60609

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all PeopleSoft Enterprise CS Campus Community deployments running version 9.2.38.
Inventory all PeopleSoft operator IDs and disable or review low-privileged accounts that are inactive or no longer required.
Restrict network exposure of the PeopleSoft web tier to trusted networks or require VPN access for non-administrative users.

Patch Information

Oracle addresses CVE-2026-60609 in the July 2026 Critical Patch Update. Administrators should download and apply the relevant PeopleSoft patch bundle referenced in the Oracle Critical Patch Update Advisory - July 2026. Follow Oracle's standard PeopleSoft patching procedure, including staging in a non-production environment, validating custom code, and applying required PeopleTools updates.

Workarounds

Oracle has not published a supported workaround; patching is the authoritative remediation.
As a compensating control, tighten permission lists and roles associated with the Communication component so that low-privileged accounts have only the minimum data access required.
Place a web application firewall or reverse proxy in front of the PeopleSoft web tier to rate-limit and inspect requests to Campus Community endpoints until the patch is deployed.

bash

# Verify PeopleSoft Campus Community application version before and after patching
# Run from the PeopleSoft application server host
psadmin -c version

# Confirm the July 2026 CPU bundle has been applied via Change Assistant logs
grep -i "cpujul2026" $PS_HOME/log/*.log