CVE-2026-60615 Overview
CVE-2026-60615 is a high-severity vulnerability in the Oracle PeopleSoft Enterprise CS Campus Community product, specifically within the Security component. The flaw affects supported version 9.2.38. An unauthenticated attacker with network access via HTTP can exploit the vulnerability without user interaction. Successful exploitation grants attackers unauthorized read access to all data accessible through PeopleSoft Enterprise CS Campus Community. Attackers can also perform unauthorized update, insert, or delete operations against a subset of that data. Oracle disclosed the issue in the July 2026 Critical Patch Update.
Critical Impact
Unauthenticated network attackers can compromise the confidentiality of all Campus Community data and modify a subset of records through HTTP requests.
Affected Products
- Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38
- Oracle PeopleSoft (Security component)
- Deployments exposing PeopleSoft Campus Community over HTTP
Discovery Timeline
- 2026-07-21 - CVE CVE-2026-60615 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Addressed in Oracle Critical Patch Update Advisory
Technical Details for CVE-2026-60615
Vulnerability Analysis
The vulnerability resides in the Security component of PeopleSoft Enterprise CS Campus Community 9.2.38. Oracle's advisory characterizes the flaw as easily exploitable over the network via HTTP. The attack requires no authentication, no elevated privileges, and no user interaction.
Exploitation impacts confidentiality significantly and integrity partially. Attackers can access all data reachable through the Campus Community application. They can also modify, insert, or delete some accessible records. Availability is not directly affected. Because Campus Community stores student records, biographical data, and academic identifiers, unauthorized access exposes sensitive personally identifiable information (PII).
Root Cause
Oracle has not disclosed the underlying weakness class in its public advisory. The Security component context and unauthenticated network reachability suggest a flaw in an authentication, authorization, or access control routine handling HTTP requests. No CWE identifier has been assigned in the NVD record.
Attack Vector
The attack vector is network-based over HTTP. An unauthenticated remote attacker sends crafted requests directly to a reachable PeopleSoft Campus Community instance. The low attack complexity indicates no special conditions or timing are required to trigger the flaw. Internet-exposed PeopleSoft deployments face the highest exposure.
No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The EPSS probability is 0.339% (percentile 26.29) as of 2026-07-23. See the Oracle Security Alert July 2026 for vendor guidance.
Detection Methods for CVE-2026-60615
Indicators of Compromise
- Unauthenticated HTTP requests to Campus Community endpoints returning sensitive record payloads
- Unexpected read, update, insert, or delete operations recorded in PeopleSoft audit logs without a corresponding authenticated session
- Anomalous access patterns from external IP addresses targeting /psp/, /psc/, or Campus Community-specific URLs
Detection Strategies
- Correlate web server access logs against application authentication logs to identify requests that reached protected resources without a valid session
- Baseline normal Campus Community query volume and alert on bulk data retrieval from single sources
- Monitor database audit trails for changes to Campus Community tables originating from anonymous or service accounts
Monitoring Recommendations
- Enable and centralize PeopleSoft application server, web server, and database audit logs
- Deploy a web application firewall (WAF) in front of PeopleSoft with logging of blocked and passed requests
- Track outbound data volume from PeopleSoft servers to detect large-scale exfiltration attempts
How to Mitigate CVE-2026-60615
Immediate Actions Required
- Apply the fixes documented in the Oracle Critical Patch Update for July 2026 to all PeopleSoft Enterprise CS Campus Community 9.2.38 deployments
- Inventory all Campus Community instances, including test and staging environments, and prioritize internet-facing systems
- Review audit logs for anomalous access dating back before patching to identify potential prior compromise
Patch Information
Oracle addressed CVE-2026-60615 in the July 2026 Critical Patch Update. Refer to the Oracle Security Alert July 2026 for the specific patch bundle, prerequisites, and application instructions for PeopleSoft Enterprise CS Campus Community 9.2.38.
Workarounds
- Restrict network access to PeopleSoft Campus Community to trusted networks and authenticated VPN users until patches are applied
- Place PeopleSoft behind a WAF with rules blocking anonymous access to Campus Community URLs
- Disable or firewall off any Campus Community endpoints that are not required for business operations
- Increase logging verbosity on the PeopleSoft web and application tiers to support incident response
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
