CVE-2026-46849: Vulnerability in the PeopleSoft Enterprise CS Student Financials product of Oracle PeopleSoft (component: Other)

Synopsis

This is an authorization or access-control vulnerability in the PeopleSoft Enterprise CS Student Financials component of Oracle PeopleSoft (version 9.2.38). A remote attacker with any valid low-privilege account can reach the affected service over HTTP and exploit the flaw without any additional victim interaction. Successful exploitation gives the attacker full read access to all student financial data and the ability to create, modify, or delete critical records within the application. No fix version has been published yet; HarborGuard is tracking the advisory and will surface a patched-image rebuild as soon as Oracle ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the PeopleSoft application over the network via HTTP; no local or physical access is required.

• AuthenticationRequired

  A valid low-privilege account is sufficient; no administrative or elevated credentials are needed, but anonymous access alone is not enough.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the exploit proceeds entirely through direct HTTP requests.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads all student financial records accessible within the PeopleSoft application, including tuition balances, payment history, and financial aid data.
• Modifies or deletes critical financial records, enabling fraudulent adjustments to student account data.
• Creates unauthorized records or transactions within the Student Financials component, potentially affecting billing and reporting integrity.