What is the CVSS score of CVE-2026-46851?

CVE-2026-46851 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle PeopleSoft are affected by CVE-2026-46851?

Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 is vulnerable to unauthenticated remote takeover through the Security component, enabling attackers to fully compromise system confidentiality,…

How to fix or mitigate CVE-2026-46851?

24 hours: Inventory all systems running PeopleSoft CS Campus Community 9.2.38 and restrict HTTP access to the application to trusted networks via firewall rules. 7 days: Deploy Web Application Firewall (WAF) rules blocking unauthenticated requests to the Security component endpoints; enable detailed audit logging for all authentication events. 30 days: Evaluate upgrade path to current PeopleSoft versions; coordinate with Oracle support for vendor-provided interim patches or workarounds; implement network microsegmentation isolating the application.

Oracle PeopleSoft CVE-2026-46851

EUVD-2026-37344 HIGH

Code Injection (CWE-94)

2026-06-16 oracle

RCE Code Injection Oracle Peoplesoft Enterprise Cs Campus Community Oracle Corporation

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

PIA is HTTP-reachable and Oracle confirms unauthenticated exploitation (AV:N/PR:N/UI:N); Oracle's 'difficult to exploit' language justifies AC:H; takeover of the app yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:45 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CS Campus Community. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 is possible via the Security component, where an unauthenticated attacker reaching the application over HTTP can fully compromise confidentiality, integrity, and availability. Oracle scores this 8.1 with high attack complexity, indicating non-trivial preconditions rather than a trivial mass-exploit primitive. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

The affected product is Oracle's PeopleSoft Enterprise Campus Solutions (CS) Campus Community module, a higher-education ERP application used by universities to manage constituent and student records, communications, and 3C (checklists/communications/comments) data. The flaw resides in the Security component, which mediates authentication and authorization within the PeopleSoft Internet Architecture (PIA) stack served over HTTP/HTTPS by the WebLogic-fronted PeopleSoft web tier. CWE is unassigned by Oracle, which is typical of CPU advisories; given an unauthenticated network vector that yields full compromise of the Security component, the root cause class is most plausibly an authentication or authorization bypass in PIA request handling, but the exact weakness has not been disclosed. CPE coverage in NVD currently lists cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_cs_campus_community with a wildcard version, while Oracle and ENISA EUVD pin the affected build to 9.2.38.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update for PeopleSoft published at https://www.oracle.com/security-alerts/cspujun2026.html, which is the authoritative source for the exact patch bundle and post-patch version covering CS Campus Community 9.2.38. Until the CPU bundle is applied, compensating controls should include restricting HTTP/HTTPS access to the PeopleSoft Internet Architecture (PIA) Campus Community URLs to authenticated VPN or campus network ranges via the web tier load balancer or WAF (trade-off: breaks self-service student access from the public internet), adding WAF rules to rate-limit and inspect requests to /psp/ and /psc/ Campus Community paths, and increasing logging on the PIA web server and AppServer for anomalous unauthenticated requests to the Security component. Avoid disabling the Security component itself, as it underpins PIA authentication.