This vulnerability affects Oracle PeopleSoft Enterprise CS Student Records, specifically version 9.2.38, in the Higher Ed Statistics Agency - UK HESA component. It is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise the system and gain unauthorized access to critical or complete data. The CVSS 3.1 base score is 7.5, reflecting a high impact on confidentiality (CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The vendor advisory references a large Critical Patch Update but does not explicitly confirm a patch or remediation level for this CVE. No known exploits in the wild have been reported.

Successful exploitation results in unauthorized access to sensitive data within PeopleSoft Enterprise CS Student Records, potentially exposing critical or all accessible data. There is no reported impact on data integrity or availability. The vulnerability is remotely exploitable without authentication, increasing the risk of data compromise.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected service where possible to reduce exposure.