cve-2026-60599

{
  "cve": "CVE-2026-60599",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "9.2.38"
            }
          }
        ],
        "enrichment": {
          "confidence": 100.0,
          "confidence_source": "inferred",
          "scores": [
            {
              "score": 100.0,
              "source": "inferred"
            },
            {
              "score": 100.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "PeopleSoft Enterprise CS Student Records",
          "source": "cna",
          "vendor": "Oracle Corporation"
        },
        "product": "peoplesoft_enterprise_cs_student_records",
        "vendor": "oracle"
      }
    ],
    "created": "2026-07-22T09:00:10.800167+00:00",
    "title": "Unauthorized Data Modification Vulnerability in Oracle PeopleSoft Student Records",
    "updated": "2026-08-12T11:45:02.959514+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$peoplesoft_enterprise_cs_student_records"
    ]
  },
  "epss": {
    "score": 0.00362
  },
  "mitre": {
    "cpes": [
      "cpe:2.3:a:oracle:peoplesoft_enterprise_cs_student_records:9.2.38:*:*:*:*:*:*:*"
    ],
    "created": "2026-07-21T21:36:04.438000+00:00",
    "description": "Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking).   The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise PeopleSoft Enterprise CS Student Records.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CS Student Records accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Student Records accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 8.1,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
      },
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2026/60xxx/CVE-2026-60599.json",
    "references": [
      "https://www.oracle.com/security-alerts/cpujul2026.html"
    ],
    "title": null,
    "updated": "2026-07-30T03:55:45.134000+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$peoplesoft_enterprise_cs_student_records"
    ],
    "weaknesses": []
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:a:oracle:peoplesoft_enterprise_campus_software_campus_community:9.2.38:*:*:*:*:*:*:*"
    ],
    "created": "2026-07-21T22:18:00.070000+00:00",
    "description": "Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking).   The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise PeopleSoft Enterprise CS Student Records.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CS Student Records accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Student Records accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 8.1,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2026/CVE-2026-60599.json",
    "references": [
      "https://www.oracle.com/security-alerts/cpujul2026.html"
    ],
    "title": null,
    "updated": "2026-07-31T20:05:59.697000+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$peoplesoft_enterprise_campus_software_campus_community"
    ],
    "weaknesses": [
      "CWE-284",
      "CWE-287"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-07-21T22:00:00+00:00",
        "data": [
          {
            "details": {
              "new": "Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking).   The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise PeopleSoft Enterprise CS Student Records.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CS Student Records accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Student Records accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).",
              "old": null
            },
            "type": "description"
          },
          {
            "details": [
              "oracle",
              "oracle$PRODUCT$peoplesoft_enterprise_cs_student_records"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:2.3:a:oracle:peoplesoft_enterprise_cs_student_records:9.2.38:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "oracle",
                "oracle$PRODUCT$peoplesoft_enterprise_cs_student_records"
              ],
              "removed": []
            },
            "type": "vendors"
          },
          {
            "details": {
              "added": [
                "https://www.oracle.com/security-alerts/cpujul2026.html"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 8.1,
                  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "e8fc9056-2407-4565-876a-44a34bdfc114"
      },
      {
        "created": "2026-07-23T23:30:00+00:00",
        "data": [
          {
            "details": {
              "new": "Low-Privilege Remote Data Modification in Oracle PeopleSoft CS Student Records",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-284",
                "CWE-285"
              ],
              "removed": []
            },
            "type": "weaknesses"
          }
        ],
        "id": "2fc5c88e-92db-4b23-9c3c-d7fe66c3dca5"
      },
      {
        "created": "2026-07-27T16:30:00+00:00",
        "data": [
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "no",
                    "Exploitation": "none",
                    "Technical Impact": "total"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "29cde4ea-daf5-41de-b8d3-6b5ab1c205fa"
      },
      {
        "created": "2026-07-28T21:45:00+00:00",
        "data": [
          {
            "details": {
              "new": null,
              "old": "Low-Privilege Remote Data Modification in Oracle PeopleSoft CS Student Records"
            },
            "type": "title"
          },
          {
            "details": {
              "added": [],
              "removed": [
                "CWE-285"
              ]
            },
            "type": "weaknesses"
          }
        ],
        "id": "4e91cc8a-a765-40f3-b732-f44fdbc1b8b4"
      },
      {
        "created": "2026-07-30T14:30:00+00:00",
        "data": [
          {
            "details": {
              "new": "Unauthorized Data Modification in Oracle PeopleSoft Student Records via HTTPS",
              "old": null
            },
            "type": "title"
          }
        ],
        "id": "c00c9112-b309-4ee9-9f39-de44f9a350e3"
      },
      {
        "created": "2026-08-02T22:00:00+00:00",
        "data": [
          {
            "details": {
              "new": null,
              "old": "Unauthorized Data Modification in Oracle PeopleSoft Student Records via HTTPS"
            },
            "type": "title"
          }
        ],
        "id": "28e726cf-02d5-4fb1-a405-474cf9ba15bd"
      },
      {
        "created": "2026-08-12T12:00:00+00:00",
        "data": [
          {
            "details": {
              "new": "Unauthorized Data Modification Vulnerability in Oracle PeopleSoft Student Records",
              "old": null
            },
            "type": "title"
          }
        ],
        "id": "b1c5357d-c320-4490-a651-cdb2daba7174"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:a:oracle:peoplesoft_enterprise_campus_software_campus_community:9.2.38:*:*:*:*:*:*:*",
        "cpe:2.3:a:oracle:peoplesoft_enterprise_cs_student_records:9.2.38:*:*:*:*:*:*:*"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "created": {
      "data": "2026-07-21T21:36:04.438000+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking).   The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise PeopleSoft Enterprise CS Student Records.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CS Student Records accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Student Records accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 8.1,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
        },
        "provider": "mitre"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.00362
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "no",
            "Exploitation": "none",
            "Technical Impact": "total"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://www.oracle.com/security-alerts/cpujul2026.html"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": "Unauthorized Data Modification Vulnerability in Oracle PeopleSoft Student Records",
      "provider": "enrichment"
    },
    "updated": {
      "data": "2026-08-12T11:45:02.959514+00:00",
      "provider": "enrichment"
    },
    "vendors": {
      "data": [
        "oracle",
        "oracle$PRODUCT$peoplesoft_enterprise_campus_software_campus_community",
        "oracle$PRODUCT$peoplesoft_enterprise_cs_student_records"
      ],
      "providers": [
        "mitre",
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-284",
        "CWE-287"
      ],
      "providers": [
        "nvd",
        "vulnrichment"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2026-07-21T21:36:04.438000+00:00",
    "description": "Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking).   The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise PeopleSoft Enterprise CS Student Records.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CS Student Records accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Student Records accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "no",
          "Exploitation": "none",
          "Technical Impact": "total"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": null,
    "updated": "2026-07-27T15:43:11.171000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2026/60xxx/CVE-2026-60599.json",
    "weaknesses": [
      "CWE-284"
    ]
  }
}