CVE-2026-60611: PeopleSoft CS Campus Information Disclosure

CVE-2026-60611 Overview

CVE-2026-60611 affects the Oracle PeopleSoft Enterprise CS Campus Community product, specifically the Security component in version 9.2.38. The vulnerability allows an unauthenticated attacker with network access via HTTP to read a subset of application data. Oracle disclosed the issue in the Oracle Security Alert July 2026 advisory. The flaw is classified as an information disclosure issue, with confidentiality impact only. No integrity or availability impacts are reported. EPSS data places exploit probability at 0.316% (23.8 percentile) as of 2026-07-23.

Critical Impact
Unauthenticated remote attackers can retrieve a subset of PeopleSoft Enterprise CS Campus Community data over HTTP without user interaction.

Affected Products

Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38
Security component of Oracle PeopleSoft
Deployments exposing PeopleSoft HTTP endpoints to untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-60611 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the Critical Patch Update July 2026

Technical Details for CVE-2026-60611

Vulnerability Analysis

The vulnerability resides in the Security component of Oracle PeopleSoft Enterprise CS Campus Community 9.2.38. An unauthenticated attacker can send crafted HTTP requests to a reachable PeopleSoft instance and retrieve data that should be access controlled. Oracle categorizes the issue as easily exploitable, which reflects the lack of required privileges, low attack complexity, and absence of user interaction. Successful exploitation exposes only a subset of application data. Integrity and availability of the PeopleSoft instance remain intact after exploitation. Oracle did not publish a CWE identifier or detailed root cause analysis in the public advisory.

Root Cause

Oracle's advisory does not disclose the underlying defect. Based on the impact profile, the root cause is a missing or improperly enforced access control check within an HTTP-exposed handler of the Campus Community Security component. Requests that should require authentication return sensitive response data to anonymous callers. See the Oracle Security Alert July 2026 for vendor-supplied details.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends a request to the vulnerable PeopleSoft endpoint without supplying credentials. The server responds with data that the caller is not authorized to view. No prior foothold, phishing, or user interaction is required. Because no verified proof-of-concept has been published and no exploit is listed in ExploitDB, defenders should treat this as a latent risk that becomes actionable if exploitation details surface publicly.

No verified exploit code is publicly available. Refer to the vendor advisory for technical remediation details.

Detection Methods for CVE-2026-60611

Indicators of Compromise

Anonymous HTTP requests to Campus Community endpoints that return non-empty response bodies with student, staff, or configuration data.
Unusual spikes in HTTP GET traffic to /psp/, /psc/, or Campus Community URL patterns from external source addresses.
Web server access logs showing successful 200 OK responses to requests lacking valid session cookies or authentication headers.

Detection Strategies

Enable verbose PeopleSoft web server and application server logging for the Campus Community module and forward logs to a centralized analytics platform.
Baseline expected authenticated traffic patterns, then alert on unauthenticated requests reaching Campus Community security paths.
Correlate WAF telemetry with PeopleSoft audit trails to identify request sequences that bypass login redirection.

Monitoring Recommendations

Monitor egress data volumes from PeopleSoft application servers for anomalous outbound response sizes to external clients.
Track user-agent strings and source IP reputation against known scanner and automation tooling signatures.
Review Oracle PeopleSoft security patch level inventory monthly to confirm CPU July 2026 has been applied.

How to Mitigate CVE-2026-60611

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all PeopleSoft Enterprise CS Campus Community 9.2.38 deployments.
Restrict inbound HTTP access to PeopleSoft servers to trusted networks or VPN clients where operationally feasible.
Audit web server logs for anonymous requests to Campus Community endpoints since the advisory publication date.

Patch Information

Oracle published the fix as part of the Critical Patch Update Advisory dated July 2026. Administrators should download and apply the patch bundle referenced in the Oracle Security Alert July 2026. Oracle recommends applying Critical Patch Updates promptly and states that unsupported product versions should be upgraded before patching.

Workarounds

Place a web application firewall in front of PeopleSoft and enforce authentication checks on Campus Community URL paths.
Disable or restrict access to Campus Community functionality that is not required for business operations until patching completes.
Require network-level authentication such as mutual TLS or reverse proxy authentication for external access to PeopleSoft.

bash

# Example: restrict Campus Community endpoints at the reverse proxy
location ~* ^/(psp|psc)/.*CAMPUS_COMMUNITY {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://peoplesoft_backend;
}