CVE-2026-46851: Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security)

Synopsis

An unauthenticated network-exploitable vulnerability exists in the Security component of Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38. An attacker with HTTP access to the service can exploit this without any credentials or victim interaction, though the attack requires meeting specific environmental conditions (AC:H). Successful exploitation results in full takeover of the PeopleSoft Enterprise CS Campus Community instance, affecting confidentiality, integrity, and availability. No fix version has been published by Oracle; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the PeopleSoft service over the network via HTTP; there is no requirement for local or physical access.

• AuthenticationNot required

  No credentials of any privilege level are needed; the attacker can target the service as an anonymous unauthenticated user.

• Victim interactionNot required

  The exploit is entirely attacker-driven and does not rely on any action from a user of the affected system.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must satisfy specific environmental conditions or timing constraints beyond basic network access before the attack will succeed.

Blast Radius

• A successful attacker achieves full takeover of the PeopleSoft Enterprise CS Campus Community instance, reading all data the application can access including student records, personal information, and session tokens.
• The attacker can write or modify persisted application data, including enrollment records, user account configurations, and security settings.
• The attacker can crash or render the application unavailable, disrupting campus community services for all end users.