CVE-2026-61104: Infoleak
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise CS Student Records accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle PeopleSoft Enterprise CS Student Records (Research Tracking)to a version that resolves this vulnerability.Fixed in 9.2.38 - Compensating control
Restrict network access to the PeopleSoft Enterprise CS Student Records Research Tracking component accessible via HTTP so only trusted sources can reach it.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61104?
The severity of CVE-2026-61104 is assessed as low with a score of 3.7.
Who is affected by CVE-2026-61104?
CVE-2026-61104 affects users of the Oracle PeopleSoft Enterprise CS Student Records product, specifically version 9.2.38.
How do I fix CVE-2026-61104?
To mitigate CVE-2026-61104, ensure that your Oracle PeopleSoft software is updated to the latest security patch provided by Oracle.
What type of attack is possible with CVE-2026-61104?
CVE-2026-61104 allows an unauthenticated attacker with network access via HTTP to compromise the PeopleSoft Enterprise.
What is the nature of the vulnerability in CVE-2026-61104?
CVE-2026-61104 is classified as an information leakage vulnerability.