This vulnerability in PeopleSoft Enterprise CS Financial Aid (version 9.2.38) involves the FM Need Analysis Calculator component. It allows an attacker with low privileges and logon access to the infrastructure where the product runs to gain unauthorized access to sensitive data within the application. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without affecting integrity or availability. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). Oracle's July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly state a fix for this vulnerability, and no direct patch links are provided. The vendor strongly recommends applying available patches promptly but patch status for this specific CVE is not confirmed.

Successful exploitation can lead to unauthorized access to critical or all accessible data within PeopleSoft Enterprise CS Financial Aid. The confidentiality of sensitive information is compromised, but there is no impact on data integrity or availability. The attacker must have low privileged logon access to the infrastructure, limiting the attack vector to internal or otherwise authenticated users.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict access to the infrastructure hosting PeopleSoft Enterprise CS Financial Aid to trusted users only.