This vulnerability affects Oracle PeopleSoft Enterprise CS Campus Community, specifically version 9.2.38. It is a security weakness categorized under CWE-200 (Exposure of Sensitive Information) that can be exploited remotely without authentication over HTTPS. The attack complexity is high, and no privileges or user interaction are required. Successful exploitation can lead to unauthorized disclosure of critical data or full access to all data accessible by the product. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact with no integrity or availability impact. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly mention a patch for this specific vulnerability, and no patch links are provided.

An attacker with network access via HTTPS could exploit this vulnerability to gain unauthorized access to sensitive or critical data within PeopleSoft Enterprise CS Campus Community 9.2.38. The impact is limited to confidentiality, with no reported integrity or availability effects. This could result in exposure of sensitive information to unauthorized parties.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed available, organizations should monitor Oracle advisories for updates and consider restricting network access to the affected service where feasible.