Government College University Faisalabad (GCUF), a public sector university in Punjab, Pakistan, has confirmed to Pakistan's Federal Investigation Agency that unauthorised parties gained access to its teachers portal and manipulated exam results. According to the university's own application to the FIA Cyber Crime Wing, as reported by TechJuice, Pakistan Observer and MM News, the intrusion touched the results of 32 students across 72 courses. GCUF says money changed hands in exchange for inflated marks, and that repeated logins to multiple faculty portals were traced to a single IP address on multiple dates. The university maintains that its Controller of Examinations caught the discrepancies before any degree or Detailed Marks Certificate based on a fraudulent result was issued.
Accounts differ on one material point. TechJuice headlines the incident as an attempt to alter marks while its body text states results were changed; Pakistan Observer and MM News frame the tampering as alleged and unproven pending the FIA investigation. All available reporting is Pakistani general and tech press citing the university's FIA filing. GCUF has published no incident statement on its own website as of this writing, and no national CERT advisory has been issued.
What Happened
The compromise surfaced through reconciliation, not through security tooling. The Controller of Examinations office found mismatches between manually maintained mark sheets and the marks displayed on the university's online portal. That divergence between the paper record and the database is the only detection mechanism named in any source.
Once the discrepancies were identified, the Controller's office withheld the affected results to block release of incorrect academic records, and the administration formally approached the FIA Cyber Crime Wing requesting a comprehensive investigation. Pakistan Observer characterises the incident as an apparently well planned intrusion and reports the FIA probe was triggered by the mismatched marks.
Two claims in the university's filing go beyond simple unauthorised access. First, GCUF alleges the unidentified individuals accepted payment from students in exchange for illegally raising marks, which reframes this from an intrusion into a commercial fraud service. Second, the filing states that the faculty portals of several teachers were accessed repeatedly from one specific IP address on multiple dates. Both claims originate from the university and are reported consistently across TechJuice, Pakistan Observer and MM News, but neither has been independently corroborated by the FIA or any technical forensic report in the public record.
Figures are consistent across sources at 32 students and 72 courses. No source gives a timeframe for the intrusion, a count of compromised teacher accounts, or a date range for the IP-linked access.
What Was Taken
This is an integrity incident, not a confirmed data theft. No source alleges exfiltration of student records, personal data, or credentials. What was affected was the accuracy of authoritative academic data:
- Exam result records for 32 students spanning 72 course entries, altered in the online system so that they no longer matched the university's manual records.
- Authenticated access to the faculty portals of an unspecified number of teachers, which in a course management system typically carries grade entry, assignment marking, and roster visibility rights.
- Trust in the wider result set. Because only reconciliation against paper caught the tampering, the true blast radius is bounded by how far back manual cross checking extends, not by any technical log the university has described publicly.
The university's stated containment outcome is that no fraudulent degree or Detailed Marks Certificate was issued from a manipulated result. Pakistan Observer reports officials as saying the integrity of the official record was ultimately preserved. That claim rests on the manual record remaining authoritative and untampered, which no source independently verifies.
Note on scale for context: a LinkedIn company profile of GCUF describes an institution of roughly 900 to 1,000 employees founded in 2002. That profile contains at least one clear factual error, placing Faisalabad in India, so treat it as indicative only. GCUF's own site describes it as a top ranked public sector university with a broad multi disciplinary programme portfolio.
Why It Matters
Grade tampering is usually filed under academic misconduct rather than threat intelligence. It belongs in both. A university result system is a system of record whose outputs feed employers, licensing bodies, scholarship committees, and immigration authorities. Corrupting it is a supply chain attack on credential verification, and the downstream consumers of a Detailed Marks Certificate have no practical way to detect manipulation upstream.
Three points matter for defenders beyond the education sector:
Integrity attacks evade availability focused monitoring. Nothing was encrypted, nothing went offline, no ransom note appeared. A small number of authenticated writes across 72 records produced no signal that any control caught. The only thing that worked was an out of band paper copy.
The monetisation model is the story. If GCUF's allegation holds, this was not opportunistic defacement but a paid service with student customers. Attack surfaces that can be monetised per transaction attract sustained, low volume, deliberately quiet abuse rather than one loud event. That is precisely the profile that annual audits and signature based detection miss.
Reused source IP indicates weak account security, not sophistication. Repeated access to several distinct teachers' portals from one address, sustained across multiple dates without triggering a block, points to credential compromise or session abuse plus an absence of impossible travel, concurrent session, and anomalous source detection. This is a control gap finding, not an advanced adversary finding.
Public sector universities in South Asia and elsewhere frequently run examination systems on legacy or lightly maintained course management platforms, with faculty accounts that lack multi factor authentication and portals exposed directly to the internet. The GCUF case is a template, not an outlier.
The Attack Technique
The initial access vector has not been disclosed. No source names the software behind the GCUF teachers portal, and no vendor advisory or CERT bulletin ties a specific product or CVE to this incident. What is on the record is the outcome: authenticated access to multiple faculty portals from one IP address across multiple dates, and unauthorised writes to result records.
The plausible paths, in rough order of likelihood given the evidence, are credential compromise through phishing or shared and weak faculty passwords, session or token abuse against the portal, insider assistance from someone with legitimate portal access, or exploitation of a web application flaw in the portal software. The paid-for-grades allegation is compatible with all four and does not by itself distinguish an external intruder from a corrupt insider using the same account repeatedly.
For context on the class of vulnerability that affects course management platforms generally, two flaws disclosed in Open eClass, formerly GUnet eClass, illustrate the pattern. CVE-2026-24666, rated medium at CVSS v3 6.5, is a cross site request forgery weakness in multiple teacher restricted endpoints that lets an attacker induce an authenticated teacher to perform unintended actions, explicitly including modifying assignment grades. CVE-2026-24773, rated high at CVSS v3 7.5, is an insecure direct object reference allowing unauthenticated remote attackers to retrieve other users' personal files by requesting predictable user identifiers. Both were patched in version 4.2 and both carry very low EPSS scores, around 0.0003, meaning exploitation in the wild is not currently observed at scale.
To be explicit: there is no evidence in any source that GCUF runs Open eClass or that either CVE was used here. These are cited only to show that grade modification via a teacher's authenticated session is a documented, patched, real world weakness class in exactly this category of software, and that a CSRF chain would produce log evidence looking much like what GCUF described, legitimate teacher accounts performing grade writes.
What Organizations Should Do
Enforce phishing resistant MFA on every grade writing account. Faculty portals with mark entry rights are privileged interfaces and should be treated as such. Password only authentication on an internet exposed grading endpoint is the single control whose absence best explains the reported access pattern.
Make grade changes append only and independently logged. Every mark modification should write an immutable audit entry capturing prior value, new value, actor, source IP, session identifier, and timestamp, stored outside the application's own database and outside the reach of application administrators. GCUF caught this on paper; the system should have caught it in logs.
Alert on behavioural anomalies, not just failed logins. Flag one source IP authenticating to multiple distinct faculty accounts, grade edits outside marking windows, bulk modifications, edits to already published results, and logins from geographies or ASNs inconsistent with a teacher's history. All of these would have fired on the pattern GCUF described.
Automate reconciliation between manual and system records. The manual cross check that detected this should run continuously and by default at the point of result finalisation, not opportunistically at review time. Publish results only after a passing reconciliation, and require dual approval from the Controller's office for any post publication change.
Patch and inventory the course management platform. Confirm what software runs your examination and teaching portals, track its CVE feed, and apply vendor fixes promptly. For Open eClass specifically, upgrade to version 4.2 or later to remediate CVE-2026-24666 and CVE-2026-24773. Where CSRF is the concern, verify anti CSRF tokens on all state changing teacher endpoints and set SameSite cookie attributes.
Plan for the fraud response, not only the technical one. Grade tampering has legal, regulatory and accreditation consequences. Establish in advance who withholds results, who notifies law enforcement, how affected students are handled when some may be complicit, and how already issued credentials would be revalidated if detection had come later. GCUF's escalation to the FIA Cyber Crime Wing was fast, but the outcome hinged on catching it before certificates were issued, which is a margin no institution should rely on.
Sources: Hackers Breach GC University Faisalabad System, Try to Alter Studen... | CVE-2026-24666 Tenable® | CVE-2026-24773 Tenable® | GCU Faisalabad Students Turn to Hackers to Change Exam Results? - P... | GC University Faces Marks Manipulation Scandal | Hackers allegedly alter students' exam results at Faisalabad varsity | GCUF – Striving for Excellence | Muhammad Awais