This vulnerability affects the Person Data component of Oracle PeopleSoft Enterprise CS Campus Community 9.2.38. It permits a low privileged attacker with network access via HTTP to compromise the application, resulting in unauthorized data manipulation (creation, deletion, modification), unauthorized partial data disclosure, and denial of service conditions. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, with low confidentiality impact, high integrity impact, and high availability impact. The vendor advisory references a July 2026 Critical Patch Update containing numerous patches but does not explicitly confirm a patch or remediation level for this CVE. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data within PeopleSoft Enterprise CS Campus Community, unauthorized read access to some data, and denial of service through application hangs or crashes. This impacts confidentiality (low), integrity (high), and availability (high) of the affected system.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a specific patch is confirmed and applied, monitor Oracle advisories for updates. No vendor advisory states that no action is required or that the issue is already mitigated.