CVE-2026-46851: Oracle PeopleSoft Campus Community Unauthenticated Remote Code Execution

Technical summary

CVE-2026-46851 is a code injection vulnerability (CWE-94) affecting PeopleSoft Enterprise CS Campus Community 9.2.38. The flaw resides in the Security component and permits unauthenticated remote code execution via HTTP. The attack has high attack complexity but requires no privileges or user interaction. The CVSS 3.1 score of 8.1 reflects the severe impact potential: complete confidentiality, integrity, and availability compromise. The network-accessible nature of the vulnerability combined with its ability to achieve full system takeover elevates risk despite the difficult exploitation requirements.

Business impact

Exploitation of this vulnerability could enable attackers to completely compromise campus community operations, including student records, enrollment data, and administrative functions. Financial impact includes potential ransom demands, mandatory incident response and forensics, regulatory notification costs, and reputational damage to the institution. Educational organizations depend on PeopleSoft for mission-critical enrollment and financial aid processing; service disruption directly impairs institutional operations.

Affected systems

Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38 is confirmed vulnerable. Organizations running this specific version on internet-facing or network-accessible deployments face direct risk. Legacy or non-standard deployment configurations should be audited to identify all instances. Verify your exact patch level against Oracle's advisory, as adjacent versions may or may not be affected.

Exploitability

The vulnerability is classified as difficult to exploit, indicated by high attack complexity in the CVSS vector. However, difficulty should not be conflated with impossibility. An unauthenticated attacker needs only network access and HTTP connectivity; no credentials, multi-factor authentication, or user interaction is required. The barrier to exploitation is technical, not procedural. Once an attacker identifies and reaches a vulnerable instance, the path to code execution exists. The absence of the vulnerability from CISA's Known Exploited Vulnerabilities catalog (as of the published date) suggests public exploits are not yet widely available, but this status is time-dependent and subject to change.

Remediation

Immediate action required: contact Oracle for available security patches for PeopleSoft Enterprise CS Campus Community 9.2.38 and apply them urgently. Until patching is feasible, implement network segmentation to restrict HTTP access to the vulnerable application from untrusted networks. Deploy Web Application Firewall (WAF) rules to detect and block suspicious HTTP requests to Security component endpoints. Monitor audit logs for unusual authentication or code execution attempts. Consider a temporary reduction in external accessibility if operationally viable.

Patch guidance

Verify the latest security patch version directly from Oracle's PeopleSoft security advisory for version 9.2.38. Apply patches in a pre-production environment first to validate application stability and integration integrity. Given the complete compromise potential, expedited patch deployment is warranted despite the difficult exploitation classification. Coordinate with Oracle support if patch availability or applicability questions arise for your deployment variant.

Detection guidance

Monitor HTTP traffic to PeopleSoft Campus Community endpoints for unusual requests, especially to Security-related components or endpoints that process dynamic code. Examine web server and application logs for patterns indicative of code injection: encoded payloads, script-like syntax in HTTP parameters, and requests from unexpected source IP ranges. Configure alerting for authentication anomalies and unexpected privilege escalations following HTTP requests. Host-based detection should flag unusual process execution spawning from the PeopleSoft application process. Network behavior analysis can identify data exfiltration following a successful compromise.

Why prioritize this

This vulnerability merits high priority despite being difficult to exploit. The combination of unauthenticated access, network reachability, and complete system takeover capability makes it a credible attack vector. Educational institutions operating PeopleSoft are lucrative targets for ransomware and data theft operations. The absence of public exploits provides a narrow window for remediation before the threat landscape shifts. Organizations should prioritize this above lower-severity vulnerabilities and treat patch deployment as urgent.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH severity) reflects the maximum impact potential: complete loss of confidentiality, integrity, and availability. The score is appropriately elevated despite high attack complexity because unauthenticated network access and no user interaction lower the effective barrier to exploitation in real-world scenarios. The high score appropriately signals that successful exploitation is catastrophic, even if execution is technically challenging.

Frequently asked questions