This vulnerability in Oracle PeopleSoft Enterprise CS Campus Community (component: Integration and Interfaces) version 9.2.38 allows a low privileged attacker with network access via HTTP to compromise the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires network access, low attack complexity, and low privileges, with no user interaction needed. Successful exploitation can result in complete takeover of the affected system. The vulnerability is tracked as CVE-2026-60594 with a CVSS score of 8.8. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a fix for this version or vulnerability in the provided content.

Successful exploitation of this vulnerability can lead to full compromise of PeopleSoft Enterprise CS Campus Community version 9.2.38, impacting confidentiality, integrity, and availability of the system. An attacker with low privileges and network access via HTTP can take over the system, potentially leading to unauthorized data access and control.

Oracle has released a Critical Patch Update in July 2026 addressing multiple vulnerabilities. However, the provided advisory content does not explicitly confirm a patch or remediation for PeopleSoft Enterprise CS Campus Community version 9.2.38 or CVE-2026-60594 specifically. Customers should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply relevant patches promptly. Until an official fix is confirmed and applied, consider limiting network exposure of the affected service and applying any recommended vendor mitigations.