PeopleSoft Campus Community EUVD-2026-47314

Exploitation requires the attacker to have direct access to the physical communication segment (local network, VLAN, or physical wire) attached to the hardware running PeopleSoft Enterprise CS Campus Community 9.2.38. This is not a remote internet-exploitable vulnerability - AV:A explicitly restricts the attack to adjacent-network scope. Attack complexity is rated High (AC:H), meaning the attacker must meet additional exploitation conditions beyond mere network proximity, such as timing requirements, specific protocol states, or traffic interception capability. No user interaction is required and no prior authentication is needed (PR:N/UI:N). Exploitation is limited by: (1) physical or layer-2 network proximity to the PeopleSoft host, (2) high complexity threshold that prevents simple or automated exploitation, and (3) the attack being scoped to a single product version (9.2.38). Campus networks with open wired access ports near server infrastructure increase realistic exposure.

Real-world risk is moderate-to-low for most organizations despite the high confidentiality impact. The CVSS 3.1 score of 5.9 reflects the adjacent-network attack vector (AV:A) and high attack complexity (AC:H), meaning an attacker cannot exploit this remotely from the internet - they must have physical or layer-2 proximity to the host running PeopleSoft. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified. No CISA KEV listing and no publicly available exploit code further reduce immediate risk. The data impact is notable: successful exploitation yields complete read access to all data accessible by the application and limited write/modify capability. In a campus environment, this may include student records (FERPA-protected), financial aid data, and personal information, elevating the regulatory consequence. The combination of AV:A and AC:H is a meaningful barrier: an attacker needs physical proximity and must overcome high-complexity exploitation conditions, making opportunistic mass exploitation unlikely. Targeted insider-threat or physical-access scenarios remain the credible threat model.

An attacker with physical access to the campus network - for example, a student or visitor who plugs into a wired network port in a lab or office near the PeopleSoft server infrastructure - positions themselves on the adjacent network segment. Leveraging the authentication bypass in the Security component, possibly via intercepted credentials or session tokens traversing the local network, the attacker gains read access to sensitive student records and limited write capability without authenticating. No public exploit code is known to exist, so this scenario currently requires significant attacker sophistication and local access.