The PSEB portal (pseb.ac.in) contains 55 critical security vulnerabilities discovered by a young researcher, including 9 critical flaws potentially enabling server takeover and 45 high severity issues. These vulnerabilities expose sensitive student data for over 10 million users. The issues were reported to PSEB and CERT-In (CERTIn-39087726) in July 2026, but no remediation has been publicly confirmed after 25 days. The researcher publicly disclosed the findings due to the absence of government response and the risk to student data privacy and security.

The vulnerabilities expose personally identifiable information and academic records of over 10 million students, including names, addresses, phone numbers, exam results, certificates, and parent information. The critical flaws could allow attackers to take over the server hosting the portal, potentially leading to full system compromise and data exfiltration. The prolonged lack of response increases the risk of exploitation and data breaches.

Patch status is not yet confirmed — check the vendor advisory or CERT-In updates for current remediation guidance. Immediate patching by PSEB is urgently recommended to address the critical and high severity vulnerabilities. Until patches are applied, restrict access to the portal and monitor for suspicious activity if possible. Public disclosure was made due to the absence of government action after 25 days.