CVE-2026-46851

HIGH

PeopleSoft Enterprise CS Campus Community 9.2.38 - Unauthenticated Remote Code Execution via HTTP

Title source: llm

Description

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CS Campus Community. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

Oracle Advisory

https://www.oracle.com/security-alerts/cspujun2026.html

Scores

CVSS v3 8.1

EPSS 0.0046

EPSS Percentile 36.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-94

Status published

Products (2)

oracle/peoplesoft_enterprise_cs_campus_community 9.2.38

Oracle Corporation/PeopleSoft Enterprise CS Campus Community 9.2.38

Published Jun 17, 2026

Tracked Since Jun 17, 2026