PeopleSoft Campus Community EUVD-2026-46975

The attack requires network access to the PeopleSoft Enterprise CS Campus Community 9.2.38 HTTP interface - no authentication or user interaction is needed once network reachability is established. The AC:H (High Complexity) rating indicates exploitation is not trivially repeatable and likely depends on specific conditions such as particular request ordering, race conditions, or configuration states that are not universally present but may be common in standard deployments. Limiting factors include the high attack complexity, which reduces the pool of capable threat actors and the reliability of exploitation attempts. There is no requirement for a privileged account or pre-existing foothold. The flaw is constrained to version 9.2.38 of the CS Campus Community module; organizations not running this exact version or not exposing the PeopleSoft HTTP interface to untrusted networks are not directly at risk from external exploitation.

The vendor-assigned CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N presents a nuanced risk profile. The I:H metric is the standout concern - attackers can create, delete, or modify critical data without any authentication, which in a campus environment could mean manipulation of student records, financial aid data, or community access controls. However, AC:H (High Complexity) materially limits opportunistic exploitation; the attack is not straightforward and likely requires specific knowledge of the target's configuration or request structure. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified. There is no CISA KEV listing, and no public POC has been identified. The combination of no-auth-required and high integrity impact elevates this above typical Medium findings for institutions running the affected version, but the AC:H constraint means this is unlikely to be exploited at scale or by unsophisticated actors. Security teams should prioritize patching over compensating controls given the authentication bypass nature.

An external attacker with network access to the PeopleSoft HTTP endpoint crafts a specially constructed request sequence that exploits the authentication bypass flaw in the Security component, gaining write access without any credentials. The attacker then modifies or deletes critical student records - such as enrollment status, financial aid eligibility, or academic history - while also reading a subset of accessible Campus Community data. No public POC has been identified, meaning this scenario currently requires non-trivial exploitation knowledge, consistent with the AC:H rating.