This vulnerability in Oracle PeopleSoft Enterprise CS Campus Community (version 9.2.38) enables a low privileged attacker with network access over HTTPS to compromise the system's Communication component. Exploitation can lead to unauthorized access to sensitive or all accessible data within the affected product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, and high confidentiality impact without affecting integrity or availability. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a fix for this CVE, and no patch links are provided. Customers are urged to remain on supported versions and apply patches promptly when available.

Successful exploitation results in unauthorized access to critical or all accessible data within PeopleSoft Enterprise CS Campus Community version 9.2.38. The confidentiality of sensitive information is compromised, but there is no impact on data integrity or system availability. This can lead to data breaches and exposure of sensitive information.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly once available and staying on actively supported versions. No specific temporary mitigations or workarounds are provided in the advisory.