Peoplesoft Enterprise Cs Financial Aid
Monthly
Critical data exposure and unauthorized modification in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 allows a low-privileged, network-authenticated attacker to bypass access controls within the Commonline Loans component via HTTP. Successful exploitation yields complete read and write access to all financial aid data accessible to the application, including sensitive student loan records. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed.
Local data integrity compromise in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 enables low-privileged users with logon access to the host infrastructure to bypass application-layer authorization controls within the Institutional Methodology Need Analysis component. Successful exploitation permits unauthorized creation, deletion, or modification of critical financial aid records and partial read access to accessible data. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; however, the low attack complexity makes exploitation straightforward for any insider or attacker with an existing host foothold.
Local unauthorized data access in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 allows a low-privileged authenticated user with logon access to the hosting infrastructure to compromise the FM Need Analysis Calculator component and read critical or complete financial aid data. The Authentication Bypass tag from EUVD-2026-46965 suggests the component fails to enforce authorization boundaries for already-authenticated low-privilege accounts, enabling horizontal or vertical privilege escalation within the application. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at the time of analysis.
Vulnerability in the PeopleSoft Enterprise CS Financial Aid component of Oracle PeopleSoft Products (subcomponent: ISIR Processing). Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.
Critical data exposure and unauthorized modification in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 allows a low-privileged, network-authenticated attacker to bypass access controls within the Commonline Loans component via HTTP. Successful exploitation yields complete read and write access to all financial aid data accessible to the application, including sensitive student loan records. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed.
Local data integrity compromise in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 enables low-privileged users with logon access to the host infrastructure to bypass application-layer authorization controls within the Institutional Methodology Need Analysis component. Successful exploitation permits unauthorized creation, deletion, or modification of critical financial aid records and partial read access to accessible data. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; however, the low attack complexity makes exploitation straightforward for any insider or attacker with an existing host foothold.
Local unauthorized data access in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 allows a low-privileged authenticated user with logon access to the hosting infrastructure to compromise the FM Need Analysis Calculator component and read critical or complete financial aid data. The Authentication Bypass tag from EUVD-2026-46965 suggests the component fails to enforce authorization boundaries for already-authenticated low-privilege accounts, enabling horizontal or vertical privilege escalation within the application. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at the time of analysis.
Vulnerability in the PeopleSoft Enterprise CS Financial Aid component of Oracle PeopleSoft Products (subcomponent: ISIR Processing). Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.