CVE-2026-46849: Oracle PeopleSoft CS Student Financials Data Access Vulnerability

Technical summary

CVE-2026-46849 is an improper access control vulnerability (CWE-284) in PeopleSoft Enterprise CS Student Financials. The flaw permits low-privileged authenticated users to escalate their data access via HTTP requests without additional attack complexity. The CVSS 3.1 vector reflects network accessibility (AV:N), low attack complexity (AC:L), and low privilege requirements (PR:L) with high confidentiality and integrity impact but no availability impact. The vulnerability affects the product's component classified as 'Other,' indicating the issue spans a broad functional area rather than a single isolated module.

Business impact

Educational institutions relying on PeopleSoft for student financial management face exposure of personal financial information, tuition records, payment histories, and account balances. Beyond data exposure, attackers could alter financial records—changing account balances, refund amounts, or billing status—creating operational chaos, potential financial loss, and regulatory compliance violations. If affected systems serve multiple campuses or consortiums, the blast radius is correspondingly larger. Breach disclosure and remediation costs, coupled with institutional reputation damage, make this a high-priority risk.

Affected systems

Only PeopleSoft Enterprise CS Student Financials version 9.2.38 is confirmed affected. Organizations running this specific version should assume exposure. Verify your current version against your PeopleSoft deployment records. Confirm whether your instance is exposed to HTTP-based access from untrusted networks or whether network segmentation limits attack surface.

Exploitability

The vulnerability is exploitable by any user with valid network credentials. No zero-day complexity exists—an attacker with legitimate (even low-privilege) account access can craft HTTP requests to access or modify data outside their intended scope without bypassing multi-factor authentication or additional approval steps. This is categorized as 'easily exploitable' by Oracle, meaning the barrier to weaponization is low.

Remediation

Apply the security patch from Oracle when released. Oracle's June 2026 security bulletin provides updated build numbers and patches for affected versions. Until patching, implement compensating controls: restrict network access to PeopleSoft via IP allowlist or VPN, enforce role-based access control at the application level, enable detailed audit logging on all data modification events, and monitor for unusual data access or deletion patterns by low-privilege accounts.

Patch guidance

Monitor Oracle's PeopleSoft security advisories for version 9.2.38 patches. Apply patches in a controlled manner—test in a staging environment first to confirm compatibility with your customizations and integrations. Verify against the vendor advisory for exact patch version numbers and installation procedures. Prioritize patching higher because the issue is easily exploitable by internal users. Establish a maintenance window to minimize disruption to students and finance staff.

Detection guidance

Enable HTTP request logging at the application and web server level. Look for low-privilege user accounts making HTTP requests to financial data endpoints they typically do not access. Track modifications to critical financial fields (balances, refund amounts, scholarship amounts) when initiated by accounts that should not possess that authority. Correlate login events with unusual data access timing. Use SIEM rules to flag bulk data read operations from low-privilege sessions, particularly outside normal business hours.

Why prioritize this

This vulnerability combines high CVSS score (8.1), ease of exploitation (low complexity, low privilege required), and high-value target data (financial records). It does not yet appear on CISA's Known Exploited Vulnerabilities catalog, but the easily exploitable nature means public proof-of-concept or active exploitation could emerge quickly once awareness spreads. Internal threat actors and compromised accounts pose immediate risk. Educational institutions typically have large populations of low-privileged users (students, staff), multiplying the attack surface. Patch as soon as possible.

Risk score, explained

CVSS 8.1 (HIGH) reflects network accessibility, low attack complexity, low privilege requirement, high confidentiality impact, and high integrity impact. The score does not assume active exploitation in the wild, but the 'easily exploitable' description and absence of user interaction (UI:N) elevate practical risk. Real-world severity is amplified by the sensitivity of financial data, the number of potential internal attackers, and the operational impact of modified records.

Frequently asked questions