According to the board, an expert team of cybersecurity professionals from various government agencies and IITs has been deployed to secure the infrastructure and strengthen security environment
CBSE also expressed gratitude to the public and the cybersecurity community for flagging the system's weaknesses, encouraging citizens to alert the board about more such risks. (Source:AI)
Following serious allegations over a security breach, the Central Board of Secondary Education (CBSE) has admitted technical flaws in its online marking system. The board is now monitoring security gaps identified in the On-Screen Marking (OSM) portal. According to the board, a specialized team of cybersecurity professionals from various government agencies and the Indian Institutes of Technology (IITs) has been deployed to secure the infrastructure and strengthen security environment.
Days after students and parents leveled serious allegations against the newly implemented OSM system, the board reversed its initial stance and admitted to faults within the platform.In an official statement released on X, the board stated: "We have been closely monitoring the vulnerabilities in the OnMark portal of our service provider that are being flagged in the public domain. An expert team of cybersecurity professionals has been deployed over the last few days from across various arms of the government as well as the IITs to fortify these systems, including taking them over to a more secure set up. The identified vulnerabilities have been contained, and other exploitable weaknesses are being ruled out."
CBSE also expressed gratitude to the public and the cybersecurity community for flagging the system's weaknesses, encouraging citizens to alert the board about more such risks. "We are grateful to all alert citizens and ethical hackers pointing out such weaknesses, and have gotten in touch with some of them directly. We request any others to reach out to our security teams at secy-cbse@nic.in for any further inputs."
The vulnerability came to light after 19-year-old ethical hacker Nisarga Adhikary alleged that answer sheets and question papers stored in a CBSE-linked Amazon Web Services (AWS) bucket were publicly accessible. Adhikary exposed critical gaps in the board's digital infrastructure, triggering a national debate about data security in public education. In a social media post, Adhikary explained the misconfiguration: "CBSE people didn't configure their AWS bucket properly, and now we can paginate and enumerate all their media which has 2026 answer sheets and question papers. ListObjectsV2 works without any auth and the bucket root is listable too; anyone on the internet can download any scanned booklet, across institutions. Multiple institutions are using the same bucket, insanely insecure."
