Description
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CS Student Records. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability exists in the Research Tracking component of Oracle PeopleSoft Enterprise CS Student Records. The weakness is identified as Improper Access Control (CWE-284). The flaw permits a low‑privileged attacker with network access over HTTP to compromise the application. Successful exploitation can result in full takeover of the PeopleSoft system, compromising confidentiality, integrity, and availability of all data and services. Based on the description, it is inferred that the attacker can gain control of the application.

Affected Systems

Oracle Corporation’s PeopleSoft Enterprise CS Student Records version 9.2.38 is affected. All deployments of this exact build are at risk.

Risk and Exploitability

The CVSS v3.1 base score of 7.5 reflects a high impact severity. Attack complexity is high and required privileges are low, making exploitation somewhat difficult. The EPSS score is below 1 %, indicating a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to reach the application over HTTP and supply crafted input to the exposed Research Tracking endpoints.

Generated by OpenCVE AI on August 2, 2026 at 21:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch or upgrade to a non‑affected version of PeopleSoft Enterprise CS Student Records
  • Restrict external network access to the PeopleSoft application, limiting exposure to authorized traffic only
  • Deploy a web application firewall or other input‑validation controls to block malformed or malicious request patterns from reaching the Research Tracking component

Generated by OpenCVE AI on August 2, 2026 at 21:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Title Improper Access Control Leading to Application Takeover in Oracle PeopleSoft Enterprise CS Student Records

Thu, 30 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Title PeopleSoft Enterprise CS Student Records Application Takeover via HTTP in Research Tracking

Mon, 27 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 26 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Title PeopleSoft Enterprise CS Student Records Application Takeover via HTTP in Research Tracking
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CS Student Records. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle peoplesoft Enterprise Cs Student Records
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_cs_student_records:9.2.38:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Cs Student Records
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Peoplesoft Enterprise Cs Student Records
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-30T03:55:44.345Z

Reserved: 2026-07-08T15:51:40.546Z

Link: CVE-2026-60598

cve-icon Vulnrichment

Updated: 2026-07-27T15:38:23.103Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T21:45:03Z

Weaknesses