CVE-2026-60605 Oracle Corporation CVE debrief

Who should care

Organizations using PeopleSoft Enterprise CS Student Records, particularly those with version 9.2.38, should prioritize patching this vulnerability to prevent unauthorized data access. This is crucial for maintaining data confidentiality and preventing potential breaches. IT teams and security personnel responsible for managing PeopleSoft Enterprise CS Student Records should take immediate action to assess and mitigate this vulnerability.

Technical summary

The vulnerability is located in the Higher Ed Statistics Agency - UK HESA component of PeopleSoft Enterprise CS Student Records version 9.2.38. It allows unauthenticated attackers with network access via HTTP to compromise the system and access critical data. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a high severity vulnerability that requires immediate attention. The vulnerability's impact on data confidentiality and potential for unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Student Records accessible data should be carefully evaluated. Additional security measures, such as monitoring system logs and reviewing network access controls, should also be considered to prevent exploitation and protect sensitive data.

Defensive priority

High priority should be given to patching this vulnerability due to its high CVSS score and potential impact on data confidentiality. Additional security measures, such as monitoring system logs and reviewing network access controls, should also be considered to prevent exploitation and protect sensitive data. It is essential to confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Exceptions, retested remediated assets, and closed items should be tracked only after evidence is documented. The vulnerability's high severity and potential for unauthorized data access necessitate prompt action and thorough review of existing security measures. A thorough review of the supplied official advisory or CVE record is recommended to validate affected scope, severity, and vendor guidance. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review. The vulnerability's impact on data confidentiality and potential for unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Student Records accessible data should be carefully evaluated. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a high severity vulnerability that requires immediate attention. The vulnerability allows unauthenticated attackers with network access via HTTP to compromise the system and access critical data, emphasizing the need for prompt patching and thorough security reviews. The PeopleSoft Enterprise CS Student Records product's Higher Ed Statistics Agency - UK HESA component is affected, and its version 9.2.38 is vulnerable to this exploit. The vulnerability's CVSS score of 7.5 and vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicate a high severity vulnerability that requires immediate attention and thorough security reviews. The vulnerability's potential impact on data confidentiality and unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Student Records accessible data should be carefully evaluated, as

Recommended defensive actions

• Apply the patch provided by the vendor as soon as possible
• Review and update network access controls to prevent exploitation
• Monitor system logs for suspicious activity
• Consider implementing additional security measures to protect sensitive data
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-07-21T22:18:00.757Z and last modified on 2026-07-27T19:17:19.143Z. The NVD entry is currently Undergoing Analysis. The vulnerability has a CVSS score of 7.5 and a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify the affected product deployments and review official advisories for further details.

Official resources