This vulnerability (CVE-2026-60613) affects Oracle PeopleSoft Enterprise CS Student Records version 9.2.38, specifically the Research Tracking component. It allows a high privileged attacker with network access over HTTP to compromise the system, potentially resulting in complete takeover. The CVSS 3.1 vector indicates network attack vector (AV:N), high attack complexity (AC:H), required high privileges (PR:H), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle strongly encourages customers to remain on supported versions and apply patches without delay.

The vulnerability allows a high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records, potentially leading to full system takeover. The impact affects confidentiality, integrity, and availability of the affected system. The CVSS score of 6.6 reflects a medium severity with significant potential damage if exploited.

Oracle's July 2026 Critical Patch Update advisory does not explicitly confirm a patch for CVE-2026-60613 but strongly recommends applying all available security patches promptly and remaining on actively-supported versions. Customers should monitor Oracle's official security alerts and apply relevant patches as soon as they become available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.