This vulnerability exists in the Australian Features component of Oracle PeopleSoft Enterprise CS Student Records version 9.2.38. It allows an attacker with low privileges and network access via HTTP to fully compromise the affected system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. The vulnerability is identified as CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this CVE. Patch status is therefore not confirmed and should be verified with Oracle's advisory.

Successful exploitation can lead to complete takeover of the PeopleSoft Enterprise CS Student Records system, affecting confidentiality, integrity, and availability of data and services. This could allow unauthorized access to sensitive student records and potentially disrupt system operations.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected system and monitor for suspicious activity related to this vulnerability.