Oracle PeopleSoft EUVD-2026-46952

Exploitation requires a valid low-privileged account on the target PeopleSoft instance (CVSS PR:L) and network HTTP access to the Campus Community Integration and Interfaces / Integration Broker endpoints; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific affected deployment is PeopleSoft Enterprise CS Campus Community at version 9.2.38 - other versions are not named as affected. Limiting factors that reduce real-world risk: the mandatory authenticated account means a purely anonymous external attacker cannot exploit this directly, and exposure depends on the PIA/Integration Broker being reachable by that account. Environments with many low-privilege users or internet-facing self-service portals face materially higher realistic risk than tightly segmented internal-only deployments.

The signals converge on genuine but not emergency-level urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) shows remote exploitation over HTTP with low complexity, no user interaction, and only a low privilege requirement - meaning any authenticated PeopleSoft user can achieve full C/I/A compromise, which Oracle reinforces by calling it 'easily exploitable.' Countervailing the high score: no EPSS probability was supplied, the CVE is absent from CISA KEV, and no POC or exploit code is referenced, so there is no evidence of active or widespread exploitation. Scope is Unchanged (S:U), so impact is confined to the vulnerable module rather than the host. The one signal to reconcile is PR:L versus the 'takeover' outcome - the prerequisite valid account limits pure external attackers, so realistic risk is highest where many users hold PeopleSoft credentials (large campuses) or where credential theft/self-registration is feasible. No SSVC decision data was provided.

An attacker who holds or obtains a low-privileged PeopleSoft account - a student, staff member, or a self-registered constituent - sends crafted HTTP requests to the Campus Community Integration and Interfaces endpoints. Because the flaw is low-complexity and requires no user interaction, the attacker escalates from that limited account to full takeover of the Campus Community module, reading and altering sensitive student records. No public POC is referenced, so an attacker would need to develop the exploit or reverse-engineer the CPU patch.