CVE-2026-60614 Oracle Corporation CVE debrief

Who should care

Administrators and security teams responsible for PeopleSoft Enterprise CS Campus Community installations, particularly those using version 9.2.38, should be aware of this vulnerability and take necessary actions to mitigate potential risks.

Technical summary

The vulnerability, CVE-2026-60614, has a CVSS 3.1 Base Score of 7.1, indicating high severity. It affects the Person Data component of PeopleSoft Enterprise CS Campus Community, version 9.2.38. Exploitation requires low privileges and network access via HTTP. Successful attacks can lead to unauthorized data modifications, reads, and potential system crashes. Administrators should focus on patching or mitigating this vulnerability to prevent significant data integrity and availability impacts. The vulnerability is difficult to exploit and allows low privileged attackers with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community, potentially resulting in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise CS Campus Community accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise CS Campus Community.

Defensive priority

High priority should be given to patching or mitigating this vulnerability, as it can lead to significant data integrity and availability impacts.

Recommended defensive actions

• Apply the latest security patches from Oracle for PeopleSoft Enterprise CS Campus Community version 9.2.38.
• Implement network access controls to limit HTTP access to the vulnerable component.
• Monitor system logs for suspicious activities related to PeopleSoft Enterprise CS Campus Community.
• Conduct regular vulnerability assessments and penetration testing to identify potential weaknesses.
• Enforce strong authentication and authorization mechanisms for users with low privileges.

Evidence notes

The CVE record was published on 2026-07-21T22:18:01.793Z and was last modified on 2026-07-27T17:16:38.337Z. The NVD entry is currently Undergoing Analysis. The vulnerability details are based on the information provided by Oracle and the CVE.org record.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.