Description
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Australian Features). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CS Student Records. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in the Australian Features component of Oracle PeopleSoft Enterprise CS Student Records allows a low‑privileged attacker with network access via HTTP to compromise the entire application. The flaw is highly exploitable (CVSS 3.1 base score 8.8) and can result in full compromise, exposing or altering sensitive student records, and disrupting service availability.

Affected Systems

Oracle PeopleSoft Enterprise CS Student Records version 9.2.38 is affected. This applies to installations of the PeopleSoft Enterprise CS Student Records product that include the Australian Features component.

Risk and Exploitability

The vulnerability is exploitable over the public network (AV:N) with a low attack complexity (AC:L) and requires low privilege (PR:L). No user interaction is required (UI:N). The EPSS score indicates a very low probability of exploitation (less than 1 percent). The vulnerability is not listed in the CISA KEV catalog, but the high CVSS score and network accessibility make it a significant risk if left unpatched.

Generated by OpenCVE AI on August 4, 2026 at 03:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch or update released in the CPU Jul 2026 advisory for PeopleSoft Enterprise CS Student Records 9.2.38
  • Restrict HTTP access to the PeopleSoft application by configuring firewall rules or VPNs so only trusted internal networks can reach it
  • If a patch cannot be applied immediately, disable the Australian Features component or remove the vulnerable functionality from the application configuration

Generated by OpenCVE AI on August 4, 2026 at 03:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 03:45:00 +0000

Type Values Removed Values Added
Title PeopleSoft CS Student Records Vulnerability Enables Full System Takeover

Thu, 30 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Title PeopleSoft CS Student Records Vulnerability Enables Full System Takeover

Tue, 28 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Exploit Enables Full Takeover of Oracle PeopleSoft Student Records

Mon, 27 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 24 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Exploit Enables Full Takeover of Oracle PeopleSoft Student Records
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Australian Features). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CS Student Records. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle peoplesoft Enterprise Cs Student Records
CPEs cpe:2.3:a:oracle:peoplesoft_enterprise_cs_student_records:9.2.38:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle peoplesoft Enterprise Cs Student Records
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Peoplesoft Enterprise Cs Student Records
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-27T15:45:39.387Z

Reserved: 2026-07-08T15:51:40.547Z

Link: CVE-2026-60603

cve-icon Vulnrichment

Updated: 2026-07-27T15:45:25.608Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T03:30:03Z

Weaknesses