This vulnerability affects Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38 and involves a security flaw in the product's security component. An unauthenticated attacker with network access via HTTP can exploit this vulnerability to obtain unauthorized read access to certain data within the system. The CVSS 3.1 base score is 5.3, reflecting a medium severity with a confidentiality impact only (no integrity or availability impact). The vendor advisory references Oracle's Critical Patch Update for July 2026 but does not explicitly confirm a patch for this specific vulnerability. Oracle advises customers to remain on supported versions and apply security patches without delay.

Successful exploitation results in unauthorized read access to a subset of data accessible within PeopleSoft Enterprise CS Campus Community 9.2.38. There is no impact on data integrity or system availability. The confidentiality impact is limited but significant enough to warrant attention.

The vendor advisory does not explicitly confirm a patch or remediation for this vulnerability. Oracle recommends that customers apply Critical Patch Updates promptly and remain on actively supported versions. Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.