Oracle PeopleSoft EUVD-2026-46961

Exploitation requires an authenticated low-privileged PeopleSoft account (CVSS PR:L) with HTTP network access to the PeopleSoft Interaction/PIA web tier, and specifically targets the 'Australian Features' component of CS Student Records on supported version 9.2.38 - an environment that does not deploy this Australian localization component is likely not exposed. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the authentication prerequisite is the key limiting factor: this is not anonymous/unauthenticated exploitation, so an attacker must first obtain valid low-level credentials. Scope is unchanged (S:U), confining impact to the vulnerable Student Records application itself.

The Oracle-supplied CVSS 3.1 score of 8.8 is high, driven by a network attack vector, low complexity, no user interaction, and full impact on all three security properties, offset only by the PR:L requirement of a low-privileged account. Oracle's own text ('Easily exploitable') reinforces AC:L. However, external corroborating exploitation signals are weak: no EPSS score, no KEV listing, no SSVC decision, and no POC were provided, so real-world exploitation is currently unproven - this is a high-severity but not yet demonstrably-exploited issue. The requirement for an existing authenticated (low-privilege) account meaningfully limits opportunistic mass exploitation and points toward insider or credential-compromise scenarios rather than fully anonymous internet-wide attacks. Note a minor signal conflict worth flagging: the feed's Tags label this 'Information Disclosure,' yet the CVSS vector and description indicate full integrity and availability impact and complete module 'takeover' - treat the tag as incomplete and prioritize based on the C:H/I:H/A:H vector.

An attacker who holds or phishes a low-privilege PeopleSoft application account (e.g., a student, staff, or self-service user) sends crafted HTTP requests to the Australian Features Student Records component and abuses the flaw to escalate to full control of the Student Records module, reading, altering, or destroying sensitive academic records. Because attack complexity is low and no user interaction is needed, the request sequence is straightforward once authenticated; no public exploit code has been identified at time of analysis.