This vulnerability affects Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38 and involves a security flaw in the product's security component. An unauthenticated attacker with network access via HTTP could exploit this vulnerability to compromise the system, potentially leading to full takeover. The CVSS 3.1 base score is 8.1, indicating high severity with high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update and advises customers to apply the patches without delay. No specific exploit details or attack methods are disclosed. The vulnerability is tagged under CWE-94, which relates to code injection or improper control of code execution.

Successful exploitation can result in complete compromise of the PeopleSoft Enterprise CS Campus Community system, affecting confidentiality, integrity, and availability of the system. This could lead to unauthorized access, data breaches, and disruption of service. The vulnerability is exploitable remotely without authentication but is considered difficult to exploit due to required conditions.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to vulnerable components. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the June 2026 Critical Security Patch Update advisory.