This vulnerability affects Oracle PeopleSoft Enterprise CS Student Financials version 9.2.38 and permits a low privileged attacker with network access over HTTP to gain unauthorized access that can result in creation, deletion, or modification of critical data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no user interaction required. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes targeted security fixes for PeopleSoft products. Oracle recommends applying these patches immediately to prevent exploitation.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within PeopleSoft Enterprise CS Student Financials, as well as unauthorized access to all accessible data. This compromises data confidentiality and integrity but does not affect availability. The vulnerability is exploitable remotely over the network with low privileges and no user interaction, increasing the risk of compromise if unpatched.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes patches for this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users. Oracle advises maintaining actively-supported versions and applying security patches without delay. No official temporary fix is provided beyond these recommendations.