This vulnerability in Oracle PeopleSoft Enterprise CS Student Records (version 9.2.38) involves a weakness in the Research Tracking component that can be exploited by an attacker with low privileges and network access over HTTP. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Successful exploitation can lead to full takeover of the PeopleSoft Enterprise CS Student Records system. Oracle's July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly confirm a patch for this specific vulnerability or version in the provided excerpt.

Successful exploitation of this vulnerability can result in complete compromise of the PeopleSoft Enterprise CS Student Records system, impacting confidentiality, integrity, and availability of data. This could allow an attacker to take over the system, potentially leading to unauthorized data access and manipulation.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected system where possible and monitor for suspicious activity related to this vulnerability.