This vulnerability affects Oracle PeopleSoft Enterprise CS Student Records, specifically version 9.2.38. It is easily exploitable by an attacker with low privileges and network access via HTTPS. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all accessible data within the product. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts. The vulnerability is categorized under CWE-284 (Improper Access Control). No official patch or remediation level is explicitly stated in the vendor advisory, but Oracle's July 2026 Critical Patch Update advisory references multiple patches and strongly recommends applying security patches promptly.

The vulnerability allows unauthorized users with low privileges and network access to compromise the confidentiality and integrity of PeopleSoft Enterprise CS Student Records data. Attackers can create, delete, or modify critical data or gain complete access to all accessible data within the affected product version 9.2.38. This can lead to significant data breaches and manipulation of sensitive student records.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities across Oracle products, including PeopleSoft. Although the advisory does not explicitly confirm a patch for this specific version, Oracle strongly recommends that customers remain on actively supported versions and apply security patches without delay. Users of PeopleSoft Enterprise CS Student Records version 9.2.38 should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and apply any relevant updates promptly.