CVE-2026-46849: PeopleSoft Auth Bypass Vulnerability

CVE-2026-46849 Overview

CVE-2026-46849 is a high-severity access control vulnerability in the Oracle PeopleSoft Enterprise CS Student Financials product. The flaw affects version 9.2.38 and resides in an unspecified component categorized as Other. A low-privileged attacker with network access via HTTP can exploit this weakness to compromise confidentiality and integrity of the application. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, plus unauthorized read access to all data accessible by the application. The vulnerability is classified under CWE-284: Improper Access Control and was disclosed in the Oracle Security Alert June 2026.

Critical Impact
Authenticated attackers can read, modify, and delete all Student Financials data over the network with low attack complexity.

Affected Products

Oracle PeopleSoft Enterprise CS Student Financials version 9.2.38
Component: Other (unspecified subsystem within Student Financials)
Deployments accessible over HTTP/HTTPS to authenticated users

Discovery Timeline

2026-06-17 - CVE-2026-46849 published to NVD via the Oracle Security Alert June 2026
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-46849

Vulnerability Analysis

The vulnerability resides in Oracle PeopleSoft Enterprise CS Student Financials 9.2.38. It allows an authenticated attacker holding low-privilege credentials to bypass intended access restrictions over HTTP. The flaw maps to [CWE-284: Improper Access Control], indicating that the application fails to correctly enforce authorization checks before granting access to protected resources or operations.

Exploitation results in unauthorized read, write, and delete access to all data accessible by the Student Financials module. Student Financials manages tuition, billing, payments, refunds, and financial aid records, so impacted data sets are sensitive in nature. Availability is not directly impacted, but integrity damage to financial records can disrupt institutional operations.

The Exploit Prediction Scoring System (EPSS) rates exploitation likelihood at 0.362% (percentile 27.966) as of 2026-06-18. No public proof-of-concept is currently catalogued, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper access control within a Student Financials component. The application does not correctly validate that an authenticated user is authorized to perform a requested action before processing it. Because the flaw is exploitable by any low-privileged authenticated session, the privilege boundary between standard users and sensitive financial operations is effectively dissolved.

Attack Vector

The attack vector is network-based via HTTP. An attacker requires valid low-privilege credentials but no user interaction. After authenticating to the PeopleSoft application, the attacker issues crafted HTTP requests to the vulnerable component to access or alter data that should be restricted. Oracle has not published exploitation details to limit weaponization.

No verified exploit code is currently available. Refer to the Oracle Security Alert June 2026 for vendor-provided technical context.

Detection Methods for CVE-2026-46849

Indicators of Compromise

Unexpected HTTP requests from low-privilege user sessions targeting Student Financials transaction pages or component interfaces
Database audit entries showing inserts, updates, or deletes on Student Financials tables performed by accounts without the corresponding business role
Anomalous spikes in record modifications across billing, tuition, or refund tables outside normal batch windows

Detection Strategies

Review PeopleSoft application server access logs for repeated requests by the same low-privileged user to financial component URLs
Correlate authentication events with subsequent privileged data operations to identify privilege boundary violations
Enable PeopleSoft audit triggers on critical Student Financials tables to track row-level changes by user ID

Monitoring Recommendations

Forward PeopleSoft web, application, and database logs to a centralized analytics platform for cross-source correlation
Baseline normal user behavior on Student Financials components and alert on deviations such as bulk modifications by individual accounts
Monitor Oracle Critical Patch Update advisories and validate patch status across all PeopleSoft environments

How to Mitigate CVE-2026-46849

Immediate Actions Required

Apply the patch from the Oracle Security Alert June 2026 to all PeopleSoft Enterprise CS Student Financials 9.2.38 deployments
Inventory all PeopleSoft instances and confirm version 9.2.38 exposure prior to remediation
Review user accounts and revoke unnecessary low-privilege access to the Student Financials module
Audit recent transactions on Student Financials data for unauthorized creation, modification, or deletion

Patch Information

Oracle released a security fix as part of the Oracle Security Alert June 2026 (cspujun2026). Administrators should follow Oracle's standard PeopleSoft patching procedure, which includes applying the relevant PeopleSoft Update Image (PI) or Critical Patch Update bundle, validating in a non-production environment, and then promoting to production. Full vendor guidance is available in the Oracle Security Alert June 2026.

Workarounds

Restrict network access to the PeopleSoft application to trusted networks and VPN-connected users until patching completes
Enforce the principle of least privilege by removing Student Financials roles from accounts that do not require them
Enable PeopleSoft application-level auditing on financial transactions to capture forensic evidence if exploitation is attempted

bash

# Verify deployed PeopleSoft Student Financials version before and after patching
psadmin -c list
# Apply Oracle PeopleSoft Update Manager (PUM) patch from the June 2026 CPU bundle
# Reference: https://www.oracle.com/security-alerts/cspujun2026.html