CVE-2026-60615 Oracle Corporation CVE debrief

Who should care

Users of PeopleSoft Enterprise CS Campus Community 9.2.38 should prioritize patching this vulnerability to prevent unauthorized access to critical data. This includes administrators and security teams responsible for maintaining and securing PeopleSoft Enterprise CS Campus Community deployments. They should review the vulnerability details, assess their exposure, and apply necessary patches or mitigations.

Technical summary

CVE-2026-60615 is a vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

Defensive priority

High priority due to CVSS score of 8.2 and potential for unauthorized access to critical data.

Recommended defensive actions

• Apply the patch from Oracle as soon as possible
• Review and update network access controls to limit exposure
• Monitor for suspicious activity related to PeopleSoft Enterprise CS Campus Community
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-21T22:18:01.910Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. Oracle has provided a security alert for this vulnerability (ref-4). The vulnerability details are based on the CVE record and NVD entry, which may be subject to change as more information becomes available. Defenders should verify the affected scope, severity, and vendor guidance through official advisories.

Official resources