This vulnerability (CVE-2026-57912) affects Johnson & Johnson Campus Recruiting software versions prior to 2025-10-31. It is classified as CWE-602, indicating that security controls intended to be enforced on the server side are instead enforced on the client side, which can be bypassed. As a result, an unauthenticated remote attacker can view confidential data submitted by recruited students and internal notes made by interviewers. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that the attack is network-based, requires no privileges or user interaction, and impacts confidentiality with high severity. There is no vendor advisory or patch information available, and no known exploits in the wild have been reported.

The vulnerability allows unauthorized remote attackers to access sensitive personal data of recruited students and confidential interviewer notes, compromising confidentiality. There is no impact on integrity or availability reported. This exposure could lead to privacy violations and potential misuse of sensitive recruitment information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected system and monitor for unauthorized access attempts. Avoid exposing the affected software to untrusted networks if possible.