EUVD-2026-46973
GHSA-j6rv-g746-j846
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach PeopleSoft PIA over HTTP
-
DeliverySend crafted request to Campus Community
-
ExploitBypass authentication check
-
ExecutionRead all accessible campus data
-
ImpactPerform limited unauthorized data writes
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to an exposed PeopleSoft Enterprise CS Campus Community 9.2.38 instance (PeopleSoft Internet Architecture web tier); per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are required against the affected version. The primary limiting factors are therefore version-specificity (only 9.2.38 is listed as affected) and network reachability - instances kept off the public internet behind VPN/proxy access controls are not remotely exploitable by anonymous attackers. No non-default feature toggle is named in the Oracle description as a prerequisite. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, base 8.2) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction - a high-priority profile for any internet-exposed instance. Confidentiality impact is High (complete read of accessible data) while integrity is Low (partial write) and availability is unaffected. No EPSS score was provided in the input, and the CVE is not in CISA KEV, so there is no evidence of active exploitation; no POC was identified either, so exploitation probability cannot be quantified from the data given. The signals are internally consistent (unauthenticated network vector matches the 'authentication bypass' tag), so this is a genuine priority for exposed Campus Solutions deployments rather than a high-score/low-real-risk case - but the absence of EPSS and any POC suggests exploitation is currently theoretical rather than widespread. |
| Exploit ScenarioDerived | An attacker who can reach the PeopleSoft PIA web interface over HTTP sends crafted requests to Campus Community endpoints and, exploiting the authentication-bypass flaw, retrieves student and constituent records without logging in. With the same access they perform limited unauthorized inserts, updates, or deletes on some Campus Community data. No public POC has been identified, and the low attack complexity (AC:L) means no special timing or configuration is needed once the endpoint is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Unauthenticated data compromise in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) lets remote attackers reach the application over HTTP and read all data the module can access, with limited unauthorized insert/update/delete on some data. Vendor and community tags flag this as an authentication bypass, aligning with the PR:N (no privileges) CVSS vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' with a CVSS 3.1 base score of 8.2.
RemediationAI
Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory) referenced at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle CPUs bundle the Campus Solutions/Campus Community patch sets, and administrators should identify and apply the specific patch for CS Campus Community 9.2.38 from that advisory. No exact fixed version string is provided in the input, so confirm the target patch level via My Oracle Support before deployment. As compensating controls until patched, restrict network access to the PeopleSoft Internet Architecture (PIA) web tier so it is not directly internet-facing - place it behind a VPN or reverse proxy with strict allow-listing, which limits reachability but may disrupt external student/self-service access; add WAF rules in front of the PIA to detect and block anomalous unauthenticated requests to Campus Community endpoints, accepting possible false positives against legitimate traffic; and closely monitor web-server and application logs for unauthenticated access to Campus Community pages.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PeopleSoft Campus Community is the module of Oracle's PeopleSoft Campus Solutions ERP suite that manages student/constituent bio-demographic data, relationships, communications, and checklists for higher-education institutions. The affected 'Security' component governs authentication and authorization enforcement across the web-facing PIA (PeopleSoft Internet Architecture) tier. The 'Authentication Bypass' tag and the CVSS profile (AV:N/PR:N with high confidentiality and low integrity impact) point to a flaw allowing a request to bypass access-control checks and reach protected data without valid credentials. Oracle published no CWE (listed as N/A), so the precise root-cause class is not formally classified, but the behavior is consistent with broken authentication/improper access control (CWE-287/CWE-284 family).
Know when Peoplesoft Enterprise Campus Software Campus Community gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Unauthenticated network HTTP access with low complexity (AV:N/AC:L/PR:N/UI:N) yields full data read (C:H) and partial write (I:L) with no availability impact, matching the authentication-bypass behavior.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
Executive ViewAI
Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 contains an unauthenticated authentication bypass in the Security component that allows remote attackers to read all accessible module data without credentials. Organizations running this version face immediate risk of unauthorized data exposure affecting sensitive institutional records, requiring urgent isolation and access controls.
No vendor-released patch identified at time of analysis. Implement network segmentation to restrict remote access to internal networks only; deploy Web Application Firewall rules to enforce authentication token validation; implement IP address whitelisting for authorized users; enable enhanced logging and alerting on data access to the Security component; restrict database-level permissions for the module service account to minimum necessary privileges.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege-escalating takeover of Oracle PeopleSoft Enterprise CS Student Records (Campus Solutions) 9.2.38, specifically
Account takeover in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Integration and Interfaces component) lets
Data compromise in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 (Research Tracking component) lets a low-privi
Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 (Higher Ed Statistics Agency - UK
Full takeover of Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 is possible for a low-privileged attacker with
Full compromise of Oracle PeopleSoft Enterprise CS Student Records version 9.2.38 (Research Tracking component) allows a
Data manipulation and denial-of-service in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Person Data componen
Full system takeover is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking com
Unauthorized data access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows a low-privileged authenticate
Authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 exposes sensitive student and instituti
Unauthorized data disclosure in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows unauthenticated network a
Unauthenticated read access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows remote attackers to retrie
Exploit-DB