CVE-2026-60615 is a vulnerability in Oracle PeopleSoft Enterprise CS Campus Community (component: Security) version 9.2.38. It permits an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical data and the ability to update, insert, or delete some accessible data. The vulnerability has a CVSS 3.1 score of 8.2, with attack vector network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and impacts confidentiality (high) and integrity (low). The vendor advisory from Oracle's July 2026 Critical Patch Update mentions many patches but does not explicitly confirm a patch or remediation for this specific vulnerability or version. The vulnerability is categorized under CWE-287 (Improper Authentication). No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data within PeopleSoft Enterprise CS Campus Community and unauthorized modification (update, insert, delete) of some accessible data. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability reported. The vulnerability can be exploited remotely without authentication, increasing the risk of attack.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory and subsequent Oracle security advisories for current remediation guidance. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches without delay once available. Until an official patch is confirmed and applied, consider restricting network access to the affected PeopleSoft Enterprise CS Campus Community instance to trusted sources only.