PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60611 Oracle Corporation CVE debrief

A vulnerability was discovered in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The affected version is 9.2.38. This vulnerability allows an unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community, potentially leading to unauthorized read access to a subset of accessible data.

Vendor
Oracle Corporation
Product
PeopleSoft Enterprise CS Campus Community
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-27
Advisory published
2026-07-21
Advisory updated
2026-07-27

Who should care

Organizations using PeopleSoft Enterprise CS Campus Community version 9.2.38 should prioritize patching this vulnerability to prevent potential unauthorized data access. This is crucial for operators managing the affected systems, as it helps prevent exploitation. The vulnerability's impact on platform security is significant, and vulnerability management teams should ensure that patches are applied promptly. Security teams should also review and update network access controls to limit exposure and monitor system logs for suspicious activity.

Technical summary

The vulnerability has a CVSS 3.1 Base Score of 5.3, indicating a medium severity level. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), showing that the vulnerability can be exploited over the network with low attack complexity and no required privileges or user interaction. Successful attacks can result in unauthorized read access to a subset of PeopleSoft Enterprise CS Campus Community accessible data.

Defensive priority

Apply patches promptly to prevent exploitation. Review and update network access controls to limit exposure.

Recommended defensive actions

  • Apply the security patch provided by Oracle for PeopleSoft Enterprise CS Campus Community version 9.2.38.
  • Review network access controls to ensure that only authorized personnel have access to the affected system.
  • Monitor system logs for any suspicious activity related to this vulnerability.
  • Consider implementing additional security measures such as Web Application Firewalls (WAFs) to detect and prevent exploitation attempts.
  • Conduct a thorough review of the affected system's asset inventory to identify potential exposure.
  • Plan for rollback/change windows to ensure smooth patch deployment.
  • Track exceptions and retest remediated assets to verify patch effectiveness.

Evidence notes

The CVE record was published on 2026-07-21T22:18:01.463Z and was last modified on 2026-07-27T16:18:09.877Z. The NVD entry is currently Undergoing Analysis. Oracle has provided a security alert for this vulnerability (reference: https://www.oracle.com/security-alerts/cpujul2026.html).

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:01.463Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.