This vulnerability affects Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 in the Institutional Methodology Need Analysis component. It permits a low privileged attacker with logon access to the infrastructure where the software runs to compromise the application. The attacker can gain unauthorized capabilities to create, delete, or modify critical data or all accessible data within PeopleSoft Enterprise CS Financial Aid, and also read unauthorized subsets of data. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) reflects that the attack requires local access with low privileges, low attack complexity, no user interaction, and impacts confidentiality and integrity but not availability.

The impact includes unauthorized creation, deletion, or modification of critical or accessible data within PeopleSoft Enterprise CS Financial Aid, as well as unauthorized read access to some data. This can compromise data integrity and confidentiality within the affected application. The vulnerability does not impact availability. The CVSS score of 6.1 corresponds to a medium severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Oracle Critical Patch Update Advisory for July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) should be consulted for patch availability and installation instructions. Oracle strongly recommends applying security patches without delay to mitigate this and other vulnerabilities. No specific temporary mitigations or workarounds are provided in the advisory.