PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60611 Oracle Corporation CVE debrief

A vulnerability was discovered in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The affected version is 9.2.38. This vulnerability allows an unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community, potentially leading to unauthorized read access to a subset of accessible data.

Vendor
Oracle Corporation
Product
PeopleSoft Enterprise CS Campus Community
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-31
Advisory published
2026-07-21
Advisory updated
2026-07-31

Who should care

Organizations using PeopleSoft Enterprise CS Campus Community version 9.2.38 should prioritize patching this vulnerability to prevent potential unauthorized data access. This is crucial for operators managing the affected systems, as it helps prevent exploitation. The vulnerability's impact on platform security is significant, and vulnerability management teams should ensure that patches are applied promptly. Security teams should also review and update network access controls to limit exposure and monitor system logs for suspicious activity.

Technical summary

The vulnerability has a CVSS 3.1 Base Score of 5.3, indicating a medium severity level. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), showing that the vulnerability can be exploited over the network with low attack complexity and no required privileges or user interaction. Successful attacks can result in unauthorized read access to a subset of PeopleSoft Enterprise CS Campus Community accessible data.

Defensive priority

Apply patches promptly to prevent exploitation. Review and update network access controls to limit exposure.

Recommended defensive actions

  • Apply the security patch provided by Oracle for PeopleSoft Enterprise CS Campus Community version 9.2.38.
  • Review network access controls to ensure that only authorized personnel have access to the affected system.
  • Monitor system logs for any suspicious activity related to this vulnerability.
  • Consider implementing additional security measures such as Web Application Firewalls (WAFs) to detect and prevent exploitation attempts.
  • Conduct a thorough review of the affected system's asset inventory to identify potential exposure.
  • Plan for rollback/change windows to ensure smooth patch deployment.
  • Track exceptions and retest remediated assets to verify patch effectiveness.

Evidence notes

The CVE record was published on 2026-07-21T22:18:01.463Z and was last modified on 2026-07-27T16:18:09.877Z. The NVD entry is currently Undergoing Analysis. Oracle has provided a security alert for this vulnerability (reference: https://www.oracle.com/security-alerts/cpujul2026.html).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-60611 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-60611

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-60611 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-60611

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.