CVE-2026-60610: PeopleSoft Campus Community Auth Bypass

CVE-2026-60610 Overview

CVE-2026-60610 affects the Oracle PeopleSoft Enterprise CS Campus Community product within the Security component. The vulnerability impacts supported version 9.2.38. An unauthenticated attacker with network access via HTTPS can exploit this flaw despite high attack complexity. Successful exploitation results in unauthorized access to critical data or full read access to all PeopleSoft Enterprise CS Campus Community accessible data. Oracle disclosed the issue in the July 2026 Critical Patch Update. The vulnerability affects confidentiality only, with no impact to integrity or availability.

Critical Impact
Unauthenticated network attackers can gain read access to sensitive PeopleSoft Campus Community data, including student records, identifiers, and other confidential information stored in the affected instance.

Affected Products

Oracle PeopleSoft Enterprise CS Campus Community 9.2.38
Component: Security
Vendor: Oracle

Discovery Timeline

2026-07-21 - CVE CVE-2026-60610 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addressed the issue in the Oracle Critical Patch Update

Technical Details for CVE-2026-60610

Vulnerability Analysis

The vulnerability resides in the Security component of Oracle PeopleSoft Enterprise CS Campus Community 9.2.38. Campus Community stores biographic, demographic, and identification data for student and constituent records. A weakness in the security controls exposes this data to unauthenticated attackers reaching the application over HTTPS.

Oracle classifies the flaw as difficult to exploit, which indicates that specific conditions outside the attacker's control must be present for successful exploitation. When those conditions align, the attacker requires no privileges and no user interaction. The impact scope is limited to confidentiality, meaning the attacker can read data but cannot modify records or disrupt service through this issue.

Because Campus Community integrates with authentication, admissions, and financial aid modules, exposed data can include personally identifiable information (PII) and educational records protected under regulations such as FERPA.

Root Cause

Oracle has not published a detailed root cause analysis. The advisory identifies the Security component as the affected subsystem. Based on the CVSS scope classification, the vulnerable component and impacted component are the same, indicating the flaw is contained within Campus Community itself.

Attack Vector

The attacker reaches the target over the network using HTTPS. No credentials are required. The high attack complexity signals that the attacker must overcome conditions such as timing, configuration state, or race conditions to trigger the flaw. Successful attacks yield read access across data reachable by the compromised process.

No public proof-of-concept exploit has been published. The Oracle Critical Patch Update is the authoritative technical reference.

Detection Methods for CVE-2026-60610

Indicators of Compromise

Unusual volumes of HTTPS requests to PeopleSoft Campus Community endpoints from unauthenticated sessions.
Anomalous data retrieval patterns in PeopleSoft application logs targeting Campus Community security functions.
Outbound data transfers from PeopleSoft web and application tier hosts to unfamiliar destinations.

Detection Strategies

Enable PeopleSoft application server tracing and web server access logging, then baseline normal query patterns for Campus Community services.
Correlate HTTPS request rates against authenticated session counts to identify unauthenticated activity reaching protected endpoints.
Deploy web application firewall (WAF) rules that alert on repeated access attempts to Campus Community URLs without valid session tokens.

Monitoring Recommendations

Forward PeopleSoft web server, application server, and database audit logs to a centralized SIEM for correlation.
Monitor database query logs on PeopleSoft schemas for large or unusual SELECT operations against PS_PERSON, PS_NAMES, and related tables.
Track network egress from PeopleSoft tiers and alert on transfers exceeding baseline thresholds.

How to Mitigate CVE-2026-60610

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for PeopleSoft Enterprise CS Campus Community 9.2.38 as soon as change windows allow.
Inventory all PeopleSoft Campus Community deployments and confirm the running PeopleTools and application versions.
Restrict network access to Campus Community interfaces so only required user populations and integration systems can reach HTTPS endpoints.

Patch Information

Oracle addressed the vulnerability in the July 2026 Critical Patch Update. Refer to the Oracle Critical Patch Update Advisory - July 2026 for patch identifiers, download locations, and installation instructions specific to your PeopleSoft environment.

Workarounds

Place Campus Community behind a reverse proxy or WAF that enforces authentication before requests reach the application server.
Limit exposure of Campus Community to trusted networks using firewall rules and VPN gating until the patch is applied.
Increase logging verbosity on the Security component and review access patterns for anomalies during the pre-patch window.

bash

# Example: restrict HTTPS access to PeopleSoft Campus Community at the network edge
# Replace <trusted_cidr> and <peoplesoft_host> with your values
iptables -A INPUT -p tcp -s <trusted_cidr> --dport 443 -d <peoplesoft_host> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -d <peoplesoft_host> -j DROP