This vulnerability in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows a high privileged attacker with network access over HTTPS to compromise the system by unauthorized creation, deletion, or modification of critical data. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, requiring high privileges, no user interaction, unchanged scope, and high confidentiality and integrity impacts without affecting availability. The vulnerability is included in Oracle's June 2026 Critical Security Patch Update, which addresses 245 security issues across multiple products. Oracle strongly advises customers to apply this update without delay to mitigate the risk. The advisory also suggests that removing unnecessary privileges or blocking required network protocols may reduce risk temporarily. No specific patch version is listed for this product, but the vendor advisory is the authoritative source for remediation status.

Successful exploitation allows an attacker with high privileges and network access via HTTPS to gain unauthorized creation, deletion, or modification access to critical data within PeopleSoft Enterprise CS Campus Community 9.2.38. This results in a compromise of confidentiality and integrity of all accessible data in the affected product. Availability is not impacted. There are no known exploits in the wild at this time.

Oracle has released a Critical Security Patch Update in June 2026 that includes fixes for this vulnerability. Customers are strongly advised to apply the June 2026 Critical Security Patch Update for Oracle PeopleSoft Enterprise Applications promptly. Until patches are applied, risk may be reduced by blocking network protocols required by the attack or by removing unnecessary privileges from users. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status for this specific version is not explicitly detailed beyond the advisory; customers should consult the vendor advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.