University of Nottingham: Oracle WebLogic RCE used to access PeopleSoft student records

What happened

• Unauthorised activity was identified on 9 Jun 2026 in the Campus Solutions (PeopleSoft) student records platform, run in an isolated third-party-maintained environment. Possibly accessed: contact details, IDs, fee payments, bank details, bursary and visa information, dates of birth, NI numbers and protected characteristics, for students, some alumni and applicants. The university assumes the worst case.
• Root cause: per the university, an external actor exploited a vulnerability in Oracle WebLogic underpinning Campus Solutions to achieve remote code execution. This matches the mid-2026 campaign against PeopleSoft at universities covered elsewhere in the catalogue (CVE-2026-35273), but the university did not name a CVE.
• Attacker: “a cybercriminal group that also targeted other organisations”; no direct ransom demand; individuals report extortion contacts.
• Response: systems taken offline, rebuilt; ICO, NCSC, Action Fraud, OfS and UCAS notified.

Sources

• https://www.nottingham.ac.uk/home/alerts/cyber-attack-incident.aspx
• https://www.cm-alliance.com/cybersecurity-blog/june-2026-biggest-cyber-attacks-data-breaches-ransomware-attacks

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.