PatchSiren cyber security CVE debrief

CVE-2026-60616 Oracle Corporation CVE debrief

A vulnerability was discovered in PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft. The supported version that is affected is 9.2.38. This difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data.

Vendor: Oracle Corporation
Product: PeopleSoft Enterprise CS Campus Community
CVSS: MEDIUM 6.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-21
Original CVE updated: 2026-07-27
Advisory published: 2026-07-21
Advisory updated: 2026-07-27

Who should care

System administrators and security teams responsible for PeopleSoft Enterprise CS Campus Community installations, particularly those using version 9.2.38, should be aware of this vulnerability and take necessary actions to mitigate potential risks.

Technical summary

The vulnerability, CVE-2026-60616, is in the Security component of PeopleSoft Enterprise CS Campus Community, affecting version 9.2.38. It has a CVSS 3.1 Base Score of 6.5, indicating a medium severity level. The CVSS Vector is (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N), showing that the vulnerability allows network-based attacks with high attack complexity and no required privileges. Successful exploitation can lead to unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. System administrators and security teams should focus on patching or mitigating this vulnerability to prevent potential data breaches and integrity issues.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it can lead to significant data breaches and integrity issues if exploited.

Recommended defensive actions

Apply the latest security patches provided by Oracle for PeopleSoft Enterprise CS Campus Community version 9.2.38.
Implement compensating controls such as monitoring network traffic for suspicious activities related to PeopleSoft Enterprise CS Campus Community.
Conduct a thorough inventory of PeopleSoft Enterprise CS Campus Community installations to identify and prioritize patching efforts.
Restrict network access to PeopleSoft Enterprise CS Campus Community to only necessary personnel and systems.
Regularly review and update access controls to prevent unauthorized access.

Evidence notes

The CVE record was published on 2026-07-21T22:18:02.020Z and was last modified on 2026-07-27T17:16:38.587Z. The NVD entry is currently Undergoing Analysis. The vulnerability details are based on the information provided by the CVE.org and NVD.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:02.020Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.