14 Vulnerabilities Expose Citizen PII in Indian Government Systems — UPSC Portal Admin Takeover, Delhi Directorate of Education & Scholarship Portal Data Exposure

14 Vulnerabilities Expose Citizen PII in Indian Government (TL-2026-1199) is a critical-severity software vulnerability, first published 2026-07-10. It has no confirmed attribution, affects Union Public Service Commission (Government of India) UPSC Online, maps to 16 MITRE ATT&CK techniques (T1005, T1068, T1078), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-1199

Threat ID
TL-2026-1199
Severity
CRITICAL
Status
PATCHED
Category
VULNERABILITY
First published
2026-07-10
Last reviewed
2026-07-10
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, education
Target regions
india, South Asia, Delhi NCT
Detection rules
9
Indicators of compromise
15

Independent researcher Sushant Bhardwaj disclosed 14 vulnerabilities (2 critical, 4 high) across Indian government IT systems — the UPSC civil-service recruitment portal and two Delhi government directories/portals — rooted in missing authentication, broken access control, and poor identity and access management. The flaws exposed birthdays, addresses, guardians' names, schooling/scholarship records, and complete bank account numbers for at least 4,399 named individuals plus a much larger population of the millions of students and job aspirants served by these platforms, and one critical flaw could have let any unauthenticated attacker fully take over the national UPSC portal.

How 14 Vulnerabilities Expose Citizen PII in Indian Government works

In April 2026, independent cybersecurity researcher Sushant Bhardwaj found that access controls protecting two Delhi government directories were not enforced at the server level: the directories could be browsed without any authentication, and the files within followed predictable, guessable naming conventions, letting Bhardwaj enumerate private records simply by manipulating the URL path (an insecure direct object reference / predictable-resource pattern). A related information-disclosure flaw in a separate Delhi government IT portal that manages student scholarships exposed the names, guardians' names, schooling and scholarship information, and complete bank account numbers of 4,399 individuals to anyone on the open web, with no authentication barrier.

Bhardwaj went on to identify a dozen additional vulnerabilities in the UPSC (Union Public Service Commission) portal — India's primary civil-service recruitment platform, used by roughly 1.3 million applicants in a single recruitment cycle. The most severe finding was that the administrative interface controlling authentication for the entire UPSC portal was left completely open on the public internet with no access restriction, meaning any unauthenticated attacker could grant themselves administrative access and take over the portal and the applicant data it holds. A second critical-severity issue made the portal vulnerable to automated credential-stuffing/brute-force attacks due to the absence of rate limiting or account-lockout controls. Bhardwaj additionally catalogued missing browser-level security headers (e.g., CSP/HSTS/X-Frame-Options-class hardening gaps), weaknesses in cryptographic handling and OTP (one-time password) implementation, and application/session data inadvertently disclosed inside publicly accessible documents served by the portal.

Taken together, the 14 findings map to a systemic pattern across Indian e-governance platforms: authorization and identity controls implemented inconsistently or only at the client/UI layer, predictable resource naming used in lieu of access checks, and administrative surfaces exposed without network or authentication segmentation. Because these are large, high-value national systems (UPSC serves millions of job aspirants nationally; the Delhi education directorate oversees nearly two million enrolled students), the practical blast radius of any one of these flaws being exploited by a malicious actor — rather than a responsible researcher — would have been mass-scale PII exposure and potential portal-wide account takeover affecting government recruitment and welfare-disbursement operations.

Bhardwaj reported the issues through responsible-disclosure channels to the relevant Indian government bodies. The government engaged professionally with the researcher and patched all 14 issues within two to three weeks of disclosure. No CVE identifiers were assigned to any of the 14 findings, and no evidence has been reported of exploitation by a malicious third party prior to remediation — status is tracked as PATCHED with no confirmed compromise.

MITRE ATT&CK techniques used in TL-2026-1199

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Discovery

T1083 File and Directory Discovery; T1087 Account Discovery; T1619 Cloud Storage Object Discovery

Credential Access

T1110 Brute Force

Persistence

T1136 Create Account

Defense Evasion

T1211 Exploitation for Stealth

Impact

T1531 Account Access Removal

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583 Acquire Infrastructure

Reconnaissance

T1595 Active Scanning; T1596 Search Open Technical Databases

Affected products and versions in 14 Vulnerabilities Expose Citizen PII in Indian Government

  • Union Public Service Commission (Government of India) — UPSC Online Recruitment/Applicant Portal
    Vulnerable versions: production instance, pre-June 2026 patch
    Fixed in: patched production instance, post-disclosure (June 2026)
  • Directorate of Education, Government of NCT of Delhi — Delhi Government Education Directory (student records)
    Vulnerable versions: production instance, pre-June 2026 patch
    Fixed in: patched production instance, post-disclosure (June 2026)
  • Government of NCT of Delhi — Delhi Government Scholarship Portal
    Vulnerable versions: production instance, pre-June 2026 patch
    Fixed in: patched production instance, post-disclosure (June 2026)

Remediation for 14 Vulnerabilities Expose Citizen PII in Indian Government

Patches

  • Delhi government directory access controls remediated to enforce server-side authentication (patched within 2-3 weeks of disclosure)
  • Delhi scholarship portal information-disclosure vulnerability remediated; predictable file paths reworked
  • UPSC administrative/authentication interface access restricted and secured against unauthenticated takeover
  • UPSC brute-force/credential-attack exposure mitigated with authentication hardening
  • Missing security headers, OTP/cryptographic weaknesses, and public-document data exposure on UPSC portal addressed

Immediate actions

  • Enforce server-side authorization checks on every directory and document endpoint; never rely solely on client-side/UI-layer access control
  • Remove predictable, sequential, or guessable file/record naming from public-facing directories; use non-enumerable identifiers (UUIDs) with authorization checks
  • Restrict administrative interfaces to internal network segments or VPN/zero-trust access; never expose admin/auth-management consoles to the open internet
  • Implement rate limiting, account lockout, and CAPTCHA/MFA on all authentication endpoints to prevent automated credential attacks
  • Audit all publicly served documents (PDFs, exports) for embedded PII or session/application data before publication

Workarounds

  • Pending remediation, restrict administrative interfaces via firewall/allowlisting to known internal IP ranges
  • Disable or gate public directory browsing on affected government portals until server-side authorization is verified

Longer-term hardening

  • Adopt a formal identity and access management (IAM) framework across all e-governance platforms with centralized policy enforcement
  • Establish a standing vulnerability disclosure program (VDP) with CERT-In coordination for all national and state government portals
  • Mandate periodic third-party penetration testing and access-control audits for portals handling citizen PII and financial data
  • Deploy browser security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options) baseline across all government web properties
  • Modernize OTP/cryptographic implementations to current standards (TOTP with strong entropy, vetted crypto libraries)

Weaknesses (CWE) in 14 Vulnerabilities Expose Citizen PII in Indian Government

CWE-284, CWE-287, CWE-306, CWE-639, CWE-538, CWE-307, CWE-693, CWE-798, CWE-522

Timeline of 14 Vulnerabilities Expose Citizen PII in Indian Government

  • Independent researcher Sushant Bhardwaj discovers that access controls on two Delhi government directories are not enforced server-side, allowing unauthenticated browsing and enumeration of private records via predictable file naming.
  • Bhardwaj identifies a separate information-disclosure vulnerability in the Delhi government scholarship portal, exposing names, guardians' names, schooling/scholarship data, and bank account numbers for 4,399 individuals.
  • Bhardwaj begins probing the UPSC (Union Public Service Commission) portal, ultimately identifying a dozen distinct vulnerabilities rooted in poor identity and access management.
  • Critical finding: UPSC's administrative interface controlling portal authentication is discovered fully exposed to the open internet, enabling unauthenticated attacker self-provisioned admin takeover.
  • Second critical finding: UPSC portal found vulnerable to automated credential/brute-force attacks due to missing rate limiting and account lockout; additional issues cataloged (missing security headers, weak OTP/cryptography, PII in public documents).
  • Bhardwaj responsibly discloses the full set of 14 vulnerabilities to the relevant Indian government bodies / CERT-In.
  • Government agencies begin remediation work across the Delhi directories, scholarship portal, and UPSC portal following disclosure.
  • All 14 vulnerabilities patched by the Indian government within two to three weeks of disclosure; status moves to PATCHED with no confirmed malicious exploitation.
  • DarkReading publishes 'Vulnerabilities Expose Private Data in Indian Government Systems,' detailing the disclosure and remediation.

Sources cited for 14 Vulnerabilities Expose Citizen PII in Indian Government

Threats related to 14 Vulnerabilities Expose Citizen PII in Indian Government

Detection coverage for TL-2026-1199

As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1199 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats