PeopleSoft Campus Community CVE-2026-46979

Exploitation requires the attacker to possess high-privileged credentials (PR:H per the CVSS vector) with network access to the PeopleSoft Enterprise CS Campus Community 9.2.38 system over HTTPS. The vulnerability is scoped to the Integration and Interfaces component - deployments that do not expose this component over the network, or that restrict it to trusted internal segments, reduce exposure. The 'Authentication Bypass' intelligence tag suggests the flaw operates within an already-authenticated session, potentially allowing an account to exceed its intended authorization boundary within the integration subsystem. Exploitation is limited by the mandatory requirement for high-privilege authentication (an administrative or equivalent account must be obtained first), and no user interaction is needed once network access and credentials are in hand. Systems not running version 9.2.38 of PeopleSoft Enterprise CS Campus Community are not confirmed affected. Availability of the system is not impacted.

The CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N presents a nuanced risk profile. The network attack vector with low complexity and no user interaction means exploitation is straightforward once credentials are obtained, but the high privilege requirement (PR:H) is a meaningful barrier - an attacker must already control an administrative or elevated PeopleSoft account. Confidentiality and Integrity impacts are both rated High, meaning successful exploitation yields full read and write access to all Campus Community data, including sensitive student records protected under regulations like FERPA. No EPSS score is available in the provided data, preventing probabilistic exploitation forecasting. The vulnerability is not in the CISA KEV catalog and no POC has been identified, indicating no confirmed or widespread exploitation at time of analysis. In higher education environments where PeopleSoft administrative accounts may be shared, poorly protected, or numerous, the PR:H requirement provides less protection than in tightly managed enterprise contexts. The absence of an Availability impact (A:N) means this is a data compromise scenario, not a disruption scenario, which may affect incident response prioritization.

An attacker with a compromised or malicious high-privileged PeopleSoft administrator account sends crafted HTTPS requests to the Integration and Interfaces component of Campus Community 9.2.38, exploiting insufficient authorization controls to access data or perform operations beyond their legitimate role permissions. The attacker exfiltrates sensitive student records - including financial, enrollment, or personal data - or modifies critical institutional data without detection if audit logging on the integration layer is insufficient. No public proof-of-concept exists at time of analysis, limiting this to targeted or insider-threat scenarios rather than opportunistic mass exploitation.