Oracle PeopleSoft EUVD-2026-46972

Exploitation requires an authenticated low-privilege account on PeopleSoft Enterprise CS Campus Community (PR:L) with network HTTP access to the PIA web tier hosting the Person Data component; it is not exploitable by a fully unauthenticated attacker. Only version 9.2.38 is named as affected. Exploitation is further limited by high attack complexity (AC:H), meaning the attacker must meet a condition outside their direct control or execute a specific non-trivial sequence, which reduces reliability; no user interaction is required (UI:N).

The signals are mixed and point to a real but not emergency-level priority. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H, score 7.1) indicates network reachability but high attack complexity (AC:H) and a requirement for existing low-privilege authentication (PR:L), both of which materially reduce mass-exploitation likelihood. There is no EPSS score provided, no POC, and no CISA KEV listing, so there is no evidence of active or automated exploitation. SSVC-style reasoning: exploitation is 'none' observed, automatability is low given AC:H and required credentials, but technical impact is high (integrity and availability of critical campus data). The high integrity/availability impact against student data systems makes this worth patching in a normal cycle, but the AC:H + PR:L gating means it does not warrant out-of-band emergency response absent new exploitation intelligence. No conflicting data was observed between the description and the CVSS vector; both consistently describe an authenticated network attacker.

A user holding a legitimate low-privilege PeopleSoft account (for example a limited campus staff or self-service login) crafts a series of specially formed HTTP requests to the Person Data component that bypass intended authorization checks, allowing them to alter or delete critical person records or force the module into a repeatable crash. The high attack complexity implies the attacker must satisfy some non-trivial precondition or sequence, so success is not guaranteed on a single naive attempt. No public exploit code is currently known for this issue.