This vulnerability affects Oracle PeopleSoft Enterprise CS Financial Aid version 9.2.38, specifically the Commonline Loans component. It allows a low privileged attacker with network access via HTTP to compromise the system, leading to unauthorized creation, deletion, or modification of critical data or complete access to all accessible data within PeopleSoft Enterprise CS Financial Aid. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact without affecting availability. The vulnerability is categorized under CWE-284 (Improper Access Control). The Oracle Critical Patch Update advisory for July 2026 does not explicitly list a patch for this version or vulnerability, and no remediation level is provided. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by PeopleSoft Enterprise CS Financial Aid version 9.2.38. This compromises confidentiality and integrity of sensitive financial aid data but does not impact availability.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and staying on actively supported versions to mitigate risks. No specific temporary or official fix has been confirmed for this vulnerability as of the advisory date.