CVE-2026-46851: PeopleSoft Campus Community Auth Bypass

CVE-2026-46851 Overview

CVE-2026-46851 is a high-severity vulnerability in the Oracle PeopleSoft Enterprise CS Campus Community product, within the Security component. The affected supported version is 9.2.38. An unauthenticated attacker with network access over HTTP can compromise the application, though successful exploitation is rated as difficult. The Common Weakness Enumeration classification is [CWE-94] Improper Control of Generation of Code (Code Injection). Oracle disclosed the issue in its Security Alert advisory, and the entry was published to the National Vulnerability Database (NVD) on June 17, 2026.

Critical Impact
Successful exploitation results in full takeover of PeopleSoft Enterprise CS Campus Community, with high impact to confidentiality, integrity, and availability.

Affected Products

Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38
Component: Security
Deployments exposing the PeopleSoft HTTP interface to untrusted networks

Discovery Timeline

2026-06-17 - CVE-2026-46851 published to NVD
2026-06-17 - Last updated in NVD database
2026-06 - Oracle publishes Security Alert advisory referencing the issue

Technical Details for CVE-2026-46851

Vulnerability Analysis

The flaw resides in the Security component of PeopleSoft Enterprise CS Campus Community 9.2.38. It is classified as [CWE-94], indicating that attacker-controlled input is incorporated into code or instructions that the application later evaluates. An unauthenticated remote attacker reaching the HTTP interface can leverage this behavior to influence application logic and ultimately take over the affected instance. The Oracle advisory marks the attack complexity as high, meaning the attacker must satisfy preconditions or win specific application states before exploitation succeeds. The impact spans confidentiality, integrity, and availability, consistent with full product takeover. The Exploit Prediction Scoring System (EPSS) reports a probability of 0.436%.

Root Cause

The root cause is improper control over generation of code within the Security component. Input arriving via HTTP requests is not sufficiently validated or sanitized before being used in code-generating or code-evaluating logic paths. This allows an attacker to inject content interpreted as code by the PeopleSoft runtime. Oracle has not published low-level technical details beyond the advisory.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker crafts an HTTP request targeting the vulnerable PeopleSoft endpoint and triggers the code-injection path within the Security component. Because no privileges or user interaction are required, any internet-exposed or intranet-exposed instance is reachable by attackers in adjacent network positions. Refer to the Oracle Security Alert for product-specific details.

No verified proof-of-concept code is publicly available at the time of writing. The vulnerability mechanism is described in prose only because no validated exploit sample exists in trusted repositories.

Detection Methods for CVE-2026-46851

Indicators of Compromise

Unexpected outbound connections originating from PeopleSoft application or web server hosts
Creation of new administrative or service accounts within PeopleSoft following anomalous HTTP traffic
Web server logs showing crafted POST or GET requests targeting Campus Community Security endpoints with unusual payload structures
Modifications to PeopleCode, application server configuration files, or scheduled processes without a corresponding change ticket

Detection Strategies

Inspect HTTP access logs on PeopleSoft web servers for repeated requests to Campus Community URLs returning HTTP 500 or unusual response sizes
Correlate authentication events with subsequent privileged actions to surface unauthenticated activity that leads to administrative changes
Monitor the PeopleSoft application server (PSAPPSRV) for child processes spawning shells, scripting interpreters, or network utilities
Apply behavioral analytics on the PeopleSoft tier using an XDR platform such as Singularity Endpoint to flag anomalous process lineage from Java or Tuxedo workers

Monitoring Recommendations

Centralize PeopleSoft web, application, and database logs in a SIEM such as Singularity AI SIEM for cross-tier correlation
Enable file integrity monitoring on PeopleSoft binary directories, configuration files, and PS_HOME
Alert on outbound connections from PeopleSoft hosts to non-corporate destinations, particularly over HTTP, HTTPS, or DNS
Track new database accounts, role grants, and stored procedure changes in the PeopleSoft database

How to Mitigate CVE-2026-46851

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert for PeopleSoft Enterprise CS Campus Community 9.2.38
Inventory all PeopleSoft Campus Community deployments and confirm version levels against Oracle's fixed-release list
Restrict network exposure of the PeopleSoft HTTP interface to trusted networks and authenticated VPN paths
Review web server and application logs for suspicious activity dating back to the advisory publication

Patch Information

Oracle has released fixed versions through its standard advisory channel. Administrators should consult the Oracle Security Alert for the exact PeopleTools and Campus Community patch identifiers, supersession data, and prerequisite bundles. Apply the update following Oracle's documented PeopleSoft Update Manager (PUM) procedures.

Workarounds

Place the PeopleSoft web tier behind a web application firewall and block requests with code-injection patterns to Campus Community endpoints
Disable or restrict access to Campus Community Security functionality where it is not in active use until patches are applied
Enforce strict network segmentation between the PeopleSoft web tier and the broader enterprise network
Increase logging verbosity on PeopleSoft application servers to capture request payloads for forensic review

bash

# Example: restrict access to PeopleSoft Campus Community at the reverse proxy
# (nginx) until patches from Oracle Security Alert are applied
location /psc/ {
    allow 10.0.0.0/8;       # internal corporate range
    allow 192.168.0.0/16;   # internal admin range
    deny  all;
    proxy_pass http://peoplesoft_backend;
}