This vulnerability affects Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38 and involves a security weakness in the product's security component. It allows a low privileged attacker with network access via HTTP to compromise the system, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The Oracle July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation status for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to complete compromise of the PeopleSoft Enterprise CS Campus Community system, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access and control over sensitive data and system functions.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and staying on actively supported versions. Until an official patch or workaround is confirmed, restrict network access to the affected system and monitor for unusual activity consistent with exploitation attempts.