CVE-2026-46849 affects Oracle PeopleSoft Enterprise CS Student Financials version 9.2.38 and is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all accessible data within PeopleSoft Enterprise CS Student Financials. The vulnerability is scored 8.1 on CVSS 3.1, reflecting high confidentiality and integrity impacts with no impact on availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which contains 245 security patches across multiple products including PeopleSoft. The vendor strongly advises applying the update promptly. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but could affect application functionality.

The vulnerability allows unauthorized creation, deletion, or modification of critical data or full unauthorized access to all data accessible by PeopleSoft Enterprise CS Student Financials 9.2.38. This compromises the confidentiality and integrity of sensitive financial and student data managed by the product. There is no reported impact on availability. The vulnerability is exploitable remotely over the network via HTTP by an attacker with low privileges, increasing the risk of compromise if unpatched.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply this update promptly to remediate the vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, though these measures may disrupt normal application functionality. There is no indication from the vendor advisory that the vulnerability is already mitigated or requires no action.