CVE-2026-61104: PeopleSoft Information Disclosure Flaw

CVE-2026-61104 Overview

CVE-2026-61104 is an information disclosure vulnerability in the Oracle PeopleSoft Enterprise CS Student Records product, specifically within the Research Tracking component. The affected supported version is 9.2.38. An unauthenticated attacker with network access via HTTP can compromise the application, though the attack is difficult to execute. Successful exploitation results in unauthorized read access to a subset of PeopleSoft Enterprise CS Student Records data. Oracle addressed the issue in the Oracle July 2026 Security Alert.

Critical Impact
Unauthenticated network attackers can obtain unauthorized read access to a subset of Student Records data through the Research Tracking component.

Affected Products

Oracle PeopleSoft Enterprise CS Student Records 9.2.38
Component: Research Tracking
Access vector: HTTP

Discovery Timeline

2026-07-21 - CVE-2026-61104 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle publishes fix in the Oracle July 2026 Security Alert

Technical Details for CVE-2026-61104

Vulnerability Analysis

The vulnerability resides in the Research Tracking component of Oracle PeopleSoft Enterprise CS Student Records. The flaw exposes a subset of records data to unauthenticated network callers. Oracle classifies the issue as difficult to exploit, indicating that specific preconditions or timing must be met for a successful attack. The confidentiality impact is limited to a subset of accessible data. Integrity and availability are not affected, based on Oracle's advisory.

The EPSS probability of exploitation is 0.258% with a percentile of 17.376, reflecting a low likelihood of near-term exploitation activity. No public proof-of-concept exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

Oracle's advisory does not publish detailed root cause information for CVE-2026-61104. The disclosed behavior is consistent with an information exposure flaw in a web-facing PeopleSoft module. The Research Tracking component appears to serve data over HTTP without adequately restricting the fields or records returned to unauthenticated requests.

Attack Vector

An attacker requires only network access to the PeopleSoft HTTP interface. No credentials and no user interaction are required. However, high attack complexity indicates that exploitation depends on conditions outside the attacker's direct control. Successful attacks yield read-only access to a limited subset of Student Records data.

No verified exploitation code exists in public repositories. Refer to the Oracle July 2026 Security Alert for vendor-supplied technical detail.

Detection Methods for CVE-2026-61104

Indicators of Compromise

Unauthenticated HTTP requests to PeopleSoft Research Tracking endpoints originating from external or unexpected internal sources.
Anomalous response sizes or bulk data retrieval patterns from Student Records URLs.
Web server logs showing repeated probing of PeopleSoft CS Student Records paths without prior authentication events.

Detection Strategies

Baseline normal traffic to PeopleSoft Student Records endpoints and alert on deviations in request volume, source IP diversity, or user-agent patterns.
Correlate application logs with authentication events to identify data access that lacks a preceding login session.
Inspect HTTP request paths and parameters targeting Research Tracking functionality for enumeration behavior.

Monitoring Recommendations

Enable verbose access logging on PeopleSoft web servers and forward logs to a centralized analytics platform.
Monitor egress traffic from PeopleSoft application servers for unexpected outbound transfers.
Track responses to unauthenticated requests and alert on any that return record-shaped payloads.

How to Mitigate CVE-2026-61104

Immediate Actions Required

Apply the Oracle Critical Patch Update from the Oracle July 2026 Security Alert to PeopleSoft Enterprise CS Student Records 9.2.38.
Inventory all PeopleSoft deployments and confirm the patch status of the Research Tracking component.
Restrict network exposure of PeopleSoft HTTP endpoints to trusted networks where feasible.

Patch Information

Oracle addressed CVE-2026-61104 in its July 2026 Critical Patch Update. Administrators should download and apply the patch bundle referenced in the Oracle July 2026 Security Alert. Follow Oracle's documented pre-installation and validation procedures for PeopleSoft environments.

Workarounds

Place the PeopleSoft web tier behind a web application firewall and restrict access to Research Tracking URLs.
Limit exposure of Student Records endpoints to authenticated user segments via network segmentation and reverse proxy rules.
Disable or restrict the Research Tracking component if it is not required for business operations, pending patch deployment.

bash

# Example: restrict access to Research Tracking paths at the reverse proxy
# (Apache httpd configuration snippet)
<LocationMatch "^/psc/.*/RESEARCH_TRACKING/">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</LocationMatch>