EUVD-2026-46966
GHSA-925g-jf33-cgh5
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Local vector and low privilege confirmed by description requiring host logon; high integrity reflects full data modification over financial aid records with no availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the PeopleSoft Enterprise CS Financial Aid product of Oracle PeopleSoft (component: Institutional Methodology Need Analysis). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise CS Financial Aid executes to compromise PeopleSoft Enterprise CS Financial Aid. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CS Financial Aid accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise CS Financial Aid accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
AnalysisAI
Local data integrity compromise in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 enables low-privileged users with logon access to the host infrastructure to bypass application-layer authorization controls within the Institutional Methodology Need Analysis component. Successful exploitation permits unauthorized creation, deletion, or modification of critical financial aid records and partial read access to accessible data. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; however, the low attack complexity makes exploitation straightforward for any insider or attacker with an existing host foothold.
Technical ContextAI
PeopleSoft Enterprise CS Financial Aid is Oracle's campus solutions ERP module targeting higher education institutions for managing student financial aid workflows. The Institutional Methodology Need Analysis component performs need-assessment calculations that determine student eligibility - a high-value data target in academic settings. The CVSS local attack vector (AV:L) indicates the flaw manifests at the infrastructure layer rather than over a network interface, consistent with a host-resident process or file-system-level authorization failure. The 'Authentication Bypass' intelligence tag implies the vulnerability circumvents application-tier access controls - likely role-based permission enforcement within PeopleSoft's security framework - rather than the network authentication layer, which aligns with the low-privilege (PR:L) rather than no-privilege (PR:N) CVSS metric. No CWE identifier was assigned by Oracle, limiting root-cause classification to inference from available signals. Affected scope is confirmed to version 9.2.38 per Oracle's July 2026 Critical Patch Update.
RemediationAI
Apply Oracle's July 2026 Critical Patch Update (CPU) to address this vulnerability; the advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched release version number is not independently confirmed from the available references beyond the CPU announcement itself - verify the specific PeopleSoft patch bundle number directly with Oracle support. As a compensating control pending patch application, restrict OS-level logon access to the PeopleSoft application server infrastructure to only operationally necessary accounts, enforcing least-privilege principles; this directly targets the AV:L/PR:L exploitation path. Additionally, audit and tighten PeopleSoft application-tier role assignments for the Institutional Methodology Need Analysis component to reduce the population of users with write access to financial aid records. Enable and review PeopleSoft audit logging for data modification events within this component. Note that tightening host logon permissions may impact legitimate DBA and system administrator workflows and should be coordinated with operations teams.
Critical data exposure and unauthorized modification in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 allows a lo
Local unauthorized data access in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 allows a low-privileged authentic
Vulnerability in the PeopleSoft Enterprise CS Financial Aid component of Oracle PeopleSoft Products (subcomponent: ISIR
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today