CVE-2026-60616: PeopleSoft Campus Community Auth Bypass

CVE-2026-60616 Overview

CVE-2026-60616 is a security vulnerability in the Oracle PeopleSoft Enterprise CS Campus Community product, specifically within the Security component. The flaw affects supported version 9.2.38 and allows an unauthenticated attacker with network access via HTTP to compromise the application. Successful exploitation grants unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data, along with unauthorized update, insert, or delete access to a subset of that data. Oracle rates the vulnerability as difficult to exploit, but the network-facing attack surface expands its relevance for institutions running exposed PeopleSoft deployments.

Critical Impact
An unauthenticated remote attacker can access sensitive Campus Community data over HTTP and modify a subset of records, threatening confidentiality and integrity of student and institutional data.

Affected Products

Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38
Oracle PeopleSoft (Security component)
Deployments exposing PeopleSoft HTTP endpoints to untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-60616 published to the National Vulnerability Database
2026-07-21 - Oracle disclosed the vulnerability in the Oracle Security Alert July 2026
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60616

Vulnerability Analysis

The vulnerability resides in the Security component of PeopleSoft Enterprise CS Campus Community, the module institutions use to manage student demographic, biographic, and relationship data. An unauthenticated attacker can reach the flaw over HTTP without any user interaction. Oracle notes the attack complexity is high, indicating that exploitation depends on conditions outside the attacker's control, such as timing, configuration state, or specific request sequencing.

Successful exploitation results in a high confidentiality impact and a limited integrity impact. Attackers can read all data accessible to Campus Community and can perform unauthorized updates, inserts, or deletes against a portion of that data. Availability is not affected, so the attack is well suited to stealthy data theft and targeted record tampering rather than disruption.

Root Cause

Oracle has not published root-cause detail beyond identifying the Security component as the affected surface. The advisory language, combined with the unauthenticated network vector, is consistent with an access-control or authentication-boundary weakness in an HTTP-reachable Campus Community interface. Refer to the Oracle Security Alert July 2026 for vendor-authoritative details.

Attack Vector

The attack vector is network-based over HTTP against the PeopleSoft application tier. No credentials and no user interaction are required. The high attack complexity suggests the attacker must satisfy non-trivial preconditions, such as targeting a specific request flow or configuration, before the flaw can be triggered reliably. No public proof-of-concept, exploit code, or CISA KEV listing exists at the time of publication, and the EPSS score is 0.271%.

No verified exploit code is available. See the vendor advisory linked above for technical detail as Oracle publishes further guidance.

Detection Methods for CVE-2026-60616

Indicators of Compromise

Anomalous HTTP requests to PeopleSoft Campus Community endpoints originating from unauthenticated sessions or unexpected source addresses
Unexplained read, insert, update, or delete operations against Campus Community tables outside of business hours or normal application workflows
Bulk retrieval patterns against student biographic, demographic, or relationship records without a corresponding authenticated user session

Detection Strategies

Enable and review PeopleSoft application server and web server access logs for repeated unauthenticated requests to Campus Community URLs
Correlate database audit records with application session identifiers to surface data access that lacks a matching authenticated PeopleSoft session
Deploy web application firewall rules that flag malformed or unexpected HTTP request patterns targeting Campus Community components

Monitoring Recommendations

Continuously monitor HTTP traffic to PeopleSoft Internet Architecture (PIA) endpoints for volume and behavioral anomalies
Alert on privilege-sensitive Campus Community transactions that occur without a corresponding successful authentication event
Retain application, web tier, and database logs long enough to support retrospective hunting once Oracle publishes additional technical detail

How to Mitigate CVE-2026-60616

Immediate Actions Required

Apply the Oracle Critical Patch Update from the Oracle Security Alert July 2026 to all PeopleSoft Enterprise CS Campus Community 9.2.38 deployments
Inventory all PeopleSoft instances and confirm patch level for the Campus Community and Security components
Restrict PeopleSoft HTTP endpoints so they are not reachable from untrusted networks or the public internet where possible

Patch Information

Oracle addressed CVE-2026-60616 as part of the July 2026 Critical Patch Update. Administrators should follow Oracle's patch application guidance for PeopleSoft Enterprise CS Campus Community version 9.2.38 and validate the fix in a non-production environment before production rollout. Details are published in the Oracle Security Alert July 2026.

Workarounds

Place PeopleSoft Campus Community behind a reverse proxy or web application firewall configured to inspect and restrict HTTP traffic
Enforce network segmentation and VPN-only access for administrative and off-campus users until the patch is deployed
Increase logging verbosity on the PeopleSoft web and application tiers to support detection while remediation is in progress

bash

# Configuration example
# Restrict PeopleSoft PIA access to trusted network ranges at the reverse proxy
location /psp/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://peoplesoft-app-tier;
}