This vulnerability affects Oracle PeopleSoft Enterprise CS Student Financials version 9.2.38, specifically the Billing component. It is easily exploitable by an attacker with low privileges and network access over HTTP, enabling compromise and potential takeover of the affected system. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory is a general Critical Patch Update advisory listing many products and versions but does not explicitly confirm a patch or remediation status for this vulnerability or version.

Successful exploitation can lead to complete compromise of PeopleSoft Enterprise CS Student Financials 9.2.38, impacting confidentiality, integrity, and availability of the system. This could allow attackers to take over the application, potentially leading to unauthorized access to sensitive financial data and disruption of financial operations.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly and staying on actively supported versions. Until a specific patch is confirmed, organizations should consider restricting network access to the affected service and monitor for unusual activity related to PeopleSoft Enterprise CS Student Financials.