EUVD-2026-47315
GHSA-mx83-vj35-f8x6
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Aligns with vendor-provided vector: network-reachable HTTP with no auth but high complexity; confidentiality-only partial read, no integrity or availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise CS Student Records accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
AnalysisAI
Unauthorized read access to a subset of student records data is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking component over HTTP. An unauthenticated network attacker exploiting an authentication bypass condition (tagged explicitly by the reporter) can retrieve confidential academic data without credentials, though the high attack complexity constrains opportunistic mass exploitation. No public exploit code or active exploitation has been identified; however, even partial disclosure of student records carries regulatory significance under FERPA regardless of the low CVSS score of 3.7.
Technical ContextAI
The vulnerability affects the Research Tracking component of Oracle PeopleSoft Enterprise CS Student Records 9.2.38 - a higher-education ERP module within the Oracle PeopleSoft Campus Solutions suite used to manage student academic and enrollment data. The reporter tag 'Authentication Bypass' identifies the root cause class: the HTTP-accessible Research Tracking interface fails to properly enforce authentication or access control under specific conditions. No CWE has been formally assigned, which is common for Oracle CPU disclosures that withhold implementation details. The CVSS vector AV:N/AC:H/PR:N indicates the flaw is network-reachable without credentials but requires a non-trivial exploitation condition - likely a specific request sequence, session state, or timing dependency rather than a simple missing auth check. The confidentiality-only impact (C:L, I:N, A:N) and unchanged scope (S:U) confirm that exploitation yields partial data read within the Research Tracking component boundary only.
RemediationAI
Apply Oracle's Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability in the Research Tracking component of PeopleSoft Enterprise CS Student Records 9.2.38. Oracle delivers PeopleSoft patches via PeopleTools bundles or selective adoption patches - administrators should consult My Oracle Support for the specific patch number and bundle corresponding to this CPU. No exact patched version number is independently confirmed from the available intelligence; the CPU advisory is the authoritative source. As a compensating control pending patching, restricting network-level HTTP access to the Research Tracking component via perimeter firewall rules or PeopleTools permission list configurations would reduce exposure; note that this may impact faculty or staff users who legitimately use the Research Tracking feature, so change-management review is warranted before applying access restrictions.
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Class Search). Ra
Unauthorized read access to student records data in Oracle PeopleSoft Enterprise CS Student Records 9.2 (Research Tracki
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today