What is the CVSS score of EUVD-2026-46970?

EUVD-2026-46970 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

PeopleSoft CS Financial Aid EUVD-2026-46970

| CVE-2026-60612 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-5rvp-39wf-667v

Authentication Bypass Oracle Peoplesoft Enterprise Cs Financial Aid

6.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.8 MEDIUM

Network vector confirmed via HTTP; PR:L required per description; AC:H reflects difficult exploitation; no availability impact per description scope.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:02 vuln.today

DescriptionCVE.org

Vulnerability in the PeopleSoft Enterprise CS Financial Aid product of Oracle PeopleSoft (component: Commonline Loans). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Financial Aid. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise CS Financial Aid accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Financial Aid accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Critical data exposure and unauthorized modification in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 allows a low-privileged, network-authenticated attacker to bypass access controls within the Commonline Loans component via HTTP. Successful exploitation yields complete read and write access to all financial aid data accessible to the application, including sensitive student loan records. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed.

Technical ContextAI

PeopleSoft Enterprise CS Financial Aid is Oracle's campus solutions module for managing student financial aid workflows, including federal loan origination and disbursement through the Commonline Loans component - an interface to the CommonLine network used by lenders for standardized loan processing. The vulnerability is tagged 'Authentication Bypass' in ENISA EUVD-2026-46970, suggesting that within the Commonline Loans sub-component, a low-privileged authenticated user can circumvent authorization logic to access data or functionality restricted to higher-privilege roles. The CWE is not specified by NVD, but the authentication bypass tag and combined high confidentiality and integrity impact are consistent with CWE-863 (Incorrect Authorization) or CWE-285 (Improper Authorization). The affected CPE is PeopleSoft Enterprise CS Financial Aid version 9.2.38, as confirmed by the EUVD affected-versions field. The CVSS vector AV:N/AC:H reflects network exploitation over HTTP with high complexity, indicating that specific, non-trivial preconditions must align for successful exploitation.

RemediationAI

Apply the patch issued by Oracle as part of the Critical Patch Update (CPU) for July 2026, documented at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version is not independently confirmed from available input data beyond Oracle's advisory reference; consult the CPU advisory directly to identify the target patch level for PeopleSoft Enterprise CS Financial Aid. As a compensating control pending patch application, restrict network access to PeopleSoft Commonline Loans component endpoints to only authorized internal IP ranges using perimeter controls or PeopleSoft permission list configurations, accepting the trade-off of disrupting legitimate lender-interface workflows. Additionally, audit low-privileged user accounts with access to the Commonline Loans component and temporarily revoke access for non-essential accounts until the patch is applied. Monitor application logs for anomalous cross-role data access patterns within the financial aid module.