CVE-2026-60617: PeopleSoft Campus Community Auth Bypass

CVE-2026-60617 Overview

CVE-2026-60617 affects the Oracle PeopleSoft Enterprise CS Campus Community product within the Security component. The vulnerability exists in version 9.2.38 and allows an unauthenticated remote attacker to compromise the application over HTTP. Successful exploitation grants unauthorized creation, deletion, or modification of critical data across all PeopleSoft Enterprise CS Campus Community accessible data. Attackers also gain unauthorized read access to a subset of that data. Exploitation requires overcoming elevated attack complexity, but no authentication or user interaction is needed.

Critical Impact
Unauthenticated network attackers can modify or delete critical Campus Community data and read a subset of accessible records.

Affected Products

Oracle PeopleSoft Enterprise CS Campus Community, version 9.2.38
Component: Security
Deployments exposing the PeopleSoft HTTP interface to untrusted networks

Discovery Timeline

2026-07-21 - CVE-2026-60617 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60617

Vulnerability Analysis

The flaw resides in the Security component of PeopleSoft Enterprise CS Campus Community. An unauthenticated attacker with HTTP access to the application can reach the vulnerable code path directly over the network. Exploitation is difficult and depends on conditions outside the attacker's direct control, according to Oracle's advisory metadata. When conditions align, the attacker can subvert integrity controls and write, alter, or delete records that are supposed to be protected by authentication and authorization.

Because the vulnerability targets the Security component, integrity impact is high while confidentiality impact is limited to a subset of accessible data. The scope remains unchanged, meaning the attacker operates within the same security authority as the vulnerable component. Availability of the application is not directly affected by successful exploitation.

The Exploit Prediction Scoring System (EPSS) currently reports a probability of 0.258% for this CVE. No public proof-of-concept code, CISA Known Exploited Vulnerabilities listing, or in-the-wild exploitation has been reported at the time of publication.

Root Cause

Oracle has not released technical details about the underlying defect. Based on the component affected and the advisory metadata, the flaw is a broken access control or authentication bypass condition within the Security module that permits state-changing requests without valid credentials.

Attack Vector

The attack vector is network-based over HTTP. The attacker sends crafted requests to an exposed PeopleSoft Enterprise CS Campus Community instance. No prior authentication, session, or user interaction is required. Refer to the Oracle Security Alert July 2026 for vendor-specific advisory content.

Detection Methods for CVE-2026-60617

Indicators of Compromise

Unexpected creation, modification, or deletion of Campus Community records without a corresponding authenticated user session in application logs
HTTP requests to PeopleSoft Campus Community endpoints from external or unusual source IP addresses that lack authentication cookies or tokens
Anomalous response codes or payload sizes on Security component endpoints during off-hours

Detection Strategies

Correlate PeopleSoft application audit logs with web server access logs to identify state-changing operations without associated authentication events
Baseline normal HTTP request patterns to /psc/, /psp/, and Campus Community handlers, then alert on deviations in method, path, or parameter structure
Monitor database audit trails on Campus Community tables for writes originating from application sessions with no authenticated principal

Monitoring Recommendations

Forward PeopleSoft web, application, and database logs to a centralized SIEM for correlation and long-term retention
Enable verbose authentication and authorization logging on the Security component to record failed and anomalous access attempts
Alert on bulk record modifications or deletions in Campus Community modules outside approved change windows

How to Mitigate CVE-2026-60617

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all PeopleSoft Enterprise CS Campus Community 9.2.38 deployments
Inventory all PeopleSoft instances and confirm patch status against Oracle's advisory matrix
Restrict network access to PeopleSoft HTTP endpoints so only trusted networks and reverse proxies can reach the application tier
Review Campus Community audit logs for signs of unauthorized data changes preceding patch deployment

Patch Information

Oracle addressed CVE-2026-60617 in the July 2026 Critical Patch Update. Administrators must download and apply the fix documented in the Oracle Security Alert July 2026. Test the patch in a staging environment before production rollout, and verify PeopleTools compatibility with the deployed application release.

Workarounds

Place the PeopleSoft web tier behind a web application firewall (WAF) that enforces authentication before requests reach the Security component
Limit exposure of Campus Community endpoints to authenticated VPN or internal network access until patching is complete
Disable or gate unused Campus Community services to reduce the exposed attack surface

bash

# Configuration example: restrict PeopleSoft HTTP access at the reverse proxy
# Only allow internal subnets to reach Campus Community endpoints
location /psc/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://peoplesoft-app-tier;
}