CVE-2026-61104: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise CS Student Records accessible data. in Oracle Corporation PeopleSoft Enterprise CS Student Records
CVE-2026-61104 is a vulnerability in Oracle PeopleSoft Enterprise CS Student Records, specifically in the Research Tracking component. It affects version 9.2.38 and allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to a subset of accessible student records data. The vulnerability is rated as low severity with a CVSS 3.1 base score of 3.7, reflecting limited confidentiality impact and no impact on integrity or availability. Exploitation is considered difficult due to the high attack complexity. No official patch or remediation level has been confirmed yet from Oracle's advisory.
AI Analysis
Technical Summary
This vulnerability in Oracle PeopleSoft Enterprise CS Student Records (version 9.2.38) allows an unauthenticated remote attacker to read some data from the student records accessible via HTTP. The attack complexity is high, requiring specific conditions to exploit, and no privileges or user interaction are needed. The impact is limited to confidentiality, with no integrity or availability effects. Oracle's July 2026 Critical Patch Update advisory lists many patches but does not explicitly confirm a fix for this CVE or provide a remediation level. Customers are advised to monitor Oracle advisories for patch availability.
Potential Impact
Successful exploitation results in unauthorized read access to a subset of PeopleSoft Enterprise CS Student Records data. There is no impact on data integrity or system availability. The confidentiality impact is limited, and the vulnerability is rated as low severity (CVSS 3.7). No known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly once available and staying on actively supported versions. Until a patch is released, consider restricting network access to the affected service to trusted users only.
CVE-2026-61104: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise CS Student Records accessible data. in Oracle Corporation PeopleSoft Enterprise CS Student Records
Description
CVE-2026-61104 is a vulnerability in Oracle PeopleSoft Enterprise CS Student Records, specifically in the Research Tracking component. It affects version 9.2.38 and allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to a subset of accessible student records data. The vulnerability is rated as low severity with a CVSS 3.1 base score of 3.7, reflecting limited confidentiality impact and no impact on integrity or availability. Exploitation is considered difficult due to the high attack complexity. No official patch or remediation level has been confirmed yet from Oracle's advisory.
CVSS v3.1
Score 3.7low
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Oracle PeopleSoft Enterprise CS Student Records (version 9.2.38) allows an unauthenticated remote attacker to read some data from the student records accessible via HTTP. The attack complexity is high, requiring specific conditions to exploit, and no privileges or user interaction are needed. The impact is limited to confidentiality, with no integrity or availability effects. Oracle's July 2026 Critical Patch Update advisory lists many patches but does not explicitly confirm a fix for this CVE or provide a remediation level. Customers are advised to monitor Oracle advisories for patch availability.
Potential Impact
Successful exploitation results in unauthorized read access to a subset of PeopleSoft Enterprise CS Student Records data. There is no impact on data integrity or system availability. The confidentiality impact is limited, and the vulnerability is rated as low severity (CVSS 3.7). No known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly once available and staying on actively supported versions. Until a patch is released, consider restricting network access to the affected service to trusted users only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:55.613Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fee2d9c2644c7f8d5d253
Added to database: 07/21/2026, 22:09:49 UTC
Last enriched: 07/30/2026, 04:00:14 UTC
Last updated: 09/03/2026, 01:07:28 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.