Oracle PeopleSoft CVE-2026-46849

Requires (1) network HTTP access to a deployed PeopleSoft Enterprise CS Student Financials 9.2.38 instance, (2) any valid low-privileged authenticated session against that PeopleSoft environment (PR:L per CVSS - not pre-authentication), and (3) the Student Financials module being enabled and reachable from the authenticated user's role. Limiting factors: the target must be running the affected 9.2.38 release specifically, the attacker must hold credentials at any privilege tier on the PeopleSoft instance, and the vulnerable HTTP endpoints must be exposed to that account; institutions that have firewalled PIA to internal-only networks or disabled Student Financials self-service substantially shrink the attack surface. Note: a feed tag labels this 'Authentication Bypass', which would contradict the PR:L requirement - verify directly against Oracle's CPU advisory before relying on the authenticated-only assumption.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N indicates a network-reachable, low-complexity attack requiring only a low-privileged account and no user interaction, yielding full read/write impact on accessible data - a realistic priority for any institution exposing PeopleSoft to authenticated users (which is the norm for student self-service portals). No EPSS score, KEV listing, or public POC is present in the supplied intelligence, so exploitation likelihood today is unquantified. The 'Authentication Bypass' tag conflicts with the PR:L metric - if true auth bypass exists, real-world risk is materially higher than CVSS suggests; this discrepancy should be verified directly with Oracle's CPU advisory before deprioritizing. Campus self-service deployments commonly grant student-tier credentials broadly, which effectively lowers the bar for PR:L exploitation to anyone who can register.

An attacker who obtains or registers a low-privileged PeopleSoft account (for example, a student self-service login, a former-employee credential, or a phished applicant account) sends crafted HTTP requests to the Student Financials module over the standard PIA web tier. With no user interaction or additional privilege escalation required, the attacker reads or modifies tuition charges, payment records, refund destinations, or financial-aid balances belonging to other students. No public exploit identified at time of analysis, but the low attack complexity and HTTP-based vector make weaponization straightforward once technical details surface.