Oracle PeopleSoft CVE-2026-46851

Exploitation requires network reachability to the HTTP/HTTPS interface of a PeopleSoft Enterprise CS Campus Community 9.2.38 deployment and targets the Security component; no valid credentials or user interaction are needed (PR:N/UI:N). The principal limiting factor is AC:H - Oracle states the vulnerability is 'difficult to exploit,' implying success depends on conditions outside the attacker's control such as a specific configuration of the Security component, a timing/race window, or a particular request sequence that Oracle has not publicly detailed. Scope is unchanged (S:U), so impact is confined to the Campus Community application context. Deployments where the PIA web tier is not exposed to untrusted networks are not reachable by this vector.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) drives the 8.1 score: network reachable and unauthenticated, but with high attack complexity, meaning exploitation depends on conditions outside the attacker's direct control (timing, configuration, or a specific request sequence). Oracle explicitly characterizes the issue as 'difficult to exploit' and the outcome as 'takeover,' which is consistent with that vector. There is no EPSS score, no SSVC decision, no CISA KEV listing, and no public POC available in the supplied intelligence, so this should be triaged as a high-impact but currently low-evidence-of-exploitation issue. For institutions exposing PeopleSoft CS Campus Community to the internet (common in student-facing self-service portals), the unauthenticated network reachability makes it a real priority despite AC:H; for internally segmented deployments the risk is materially lower. Note that only version 9.2.38 is named, but the NVD CPE wildcard versus EUVD's single-version pin is a conflict - defenders should treat all currently deployed builds as suspect until Oracle's patch metadata confirms the fixed level.

An attacker on the internet locates a university's PeopleSoft Campus Community self-service portal, then sends a crafted sequence of HTTP requests to the Security component that exploits the specific non-trivial precondition required by the flaw; on success the attacker gains administrative control over the Campus Community application, allowing exfiltration of student/constituent PII, modification of records, or denial of service. Because Oracle marks attack complexity as High, the attacker likely needs to win a race, brute force a token, or hit a specific configuration to succeed, and no public exploit identified at time of analysis means the scenario currently requires original research.