EUVD-2026-24447Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Network HTTP delivery with low-privilege auth and mandatory victim interaction; confidentiality-only impact with no integrity or availability effect confirmed.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Student Records accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthorized read access to student records data in Oracle PeopleSoft Enterprise CS Student Records 9.2 (Research Tracking component) can be triggered by a low-privileged authenticated attacker over HTTP, provided a victim user interacts with attacker-controlled content. The flaw is rooted in improper access control (CWE-284), enabling horizontal or vertical privilege escalation within the application to expose the full scope of student records data. No public exploit exists and EPSS is extremely low at 0.03% (9th percentile), though the confidentiality impact is rated High by Oracle given the breadth of data potentially accessible.
Technical ContextAI
Oracle PeopleSoft Enterprise Campus Solutions (CS) Student Records is an ERP module widely deployed by universities and higher education institutions to manage academic and enrollment data. The affected component is Research Tracking within version 9.2 (CPE: cpe:2.3:a:oracle_corporation:peoplesoft_enterprise_cs_student_records). The root cause class is CWE-284 (Improper Access Control), which covers failures to enforce authorization checks after authentication - in this context, likely allowing a low-privileged user to read records beyond their authorized scope within the Research Tracking feature. The attack is delivered over HTTP (standard PeopleSoft web tier), and the low complexity rating indicates no special bypass technique is required beyond the access control gap itself. The 'Authentication Bypass' tag likely refers to authorization bypass (bypassing object-level or role-level controls post-login) rather than a bypass of the authentication mechanism itself - this is consistent with PR:L (authenticated, low-privileged) in the CVSS vector.
RemediationAI
Apply Oracle's Critical Patch Update issued April 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html. An exact patched version number is not independently provided beyond the CPU reference, so administrators should consult My Oracle Support (MOS) for the applicable patch ID for version 9.2. As a compensating control prior to patching, restrict network access to the PeopleSoft web tier to only authorized institutional networks and enforce role-based access controls within PeopleSoft to limit which users can access the Research Tracking component - this reduces the pool of potential low-privileged attackers. Note that UI:R means social engineering of a victim is required, so user awareness for not clicking unsolicited internal links can marginally reduce risk. No vendor-confirmed workaround that eliminates the vulnerability without patching has been identified.
Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Class Search). Ra
Unauthorized read access to a subset of student records data is possible in Oracle PeopleSoft Enterprise CS Student Reco
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today