Cybersecurity Flaws Delay CBSE Post-Result Portal Launch

The Central Board of Secondary Education (CBSE) delayed the launch of its Post-Result Activities (PRA) portal after an IIT-led cybersecurity audit uncovered several critical vulnerabilities in the Board’s digital systems.

The portal, which enables students to access post-examination services such as verification and re-evaluation of answer scripts, was scheduled to go live on June 1. However, following the discovery of security concerns, it was launched only in the early hours of June 2 after extensive testing and corrective measures.

According to officials associated with the review, expert teams from IIT Madras and IIT Kanpur identified at least four vulnerabilities classified as critical or high severity, along with several medium- and low-risk issues. One of the most serious flaws reportedly involved an access-control weakness that could have allowed a user to gain unauthorized access to other students’ answer scripts.

The cybersecurity audit was initiated after Education Minister Dharmendra Pradhan directed the IITs to assist CBSE amid growing concerns about technical glitches and complaints related to this year’s Class 12 evaluation process.

The review followed a “red team-blue team” testing model. While the blue team, comprising CBSE developers, IIT Madras experts, and the Digital India Corporation, worked to fix vulnerabilities, the red team from IIT Kanpur attempted to identify weaknesses by testing the system’s defenses.

Officials said that after a second round of testing on June 1, it appeared that major issues had been resolved. However, a subsequent red team exercise later that day uncovered fresh vulnerabilities, prompting an immediate response from developers. Following overnight repairs and a fourth round of successful testing, the portal was finally cleared for launch at around 4 a.m. on June 2.

Meanwhile, the re-evaluation process has not yet commenced. Sources indicate that CBSE has decided not to use the Coempt Edu Teck platform, which powered the On-Screen Marking system during Class 12 evaluations. Instead, all student and examination data have been migrated to infrastructure directly controlled by CBSE, and future re-evaluation activities will be conducted through the Board’s own portal.

The development underscores the growing importance of cybersecurity in managing large-scale educational data and examination systems.