CVE-2026-60607

Analyzed Analyzed - Analysis Complete

PeopleSoft CS Financial Aid Data Access Flaw

Publication date: 2026-07-21

Last updated on: 2026-08-05

Assigner: Oracle

Description

Vulnerability in the PeopleSoft Enterprise CS Financial Aid product of Oracle PeopleSoft (component: FM Need Analysis Calculator). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise CS Financial Aid executes to compromise PeopleSoft Enterprise CS Financial Aid. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Financial Aid accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-05

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60607

EUVD

EUVD-2026-46965

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	peoplesoft_enterprise_cs_financial_aid	9.2.38

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle PeopleSoft Enterprise CS Financial Aid version 9.2.38. It allows a low-privileged attacker with system access to exploit the FM Need Analysis Calculator component and gain unauthorized access to sensitive data or full access to all data within the application.

Detection Guidance

This vulnerability affects Oracle PeopleSoft Enterprise CS Financial Aid version 9.2.38. Detection requires checking the installed version of the software. No specific commands are provided in the context to detect this vulnerability directly.

Impact Analysis

If you use PeopleSoft Enterprise CS Financial Aid version 9.2.38, an attacker with local system access could steal confidential financial aid data or gain full control over the application, leading to data breaches or misuse of sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using the affected version may face compliance violations and potential penalties.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update for PeopleSoft Enterprise CS Financial Aid version 9.2.38 or later to address the vulnerability. Ensure proper access controls are enforced to limit low-privileged user access to the infrastructure where the component executes.

Hi! I’m here to help you understand CVE-2026-60607. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70