This vulnerability affects Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38 and involves a security flaw in the product's security component. An unauthenticated attacker with network access via HTTP can exploit this vulnerability, which is difficult to exploit due to high attack complexity, to gain unauthorized access to critical or all accessible data and perform unauthorized modifications such as update, insert, or delete on some data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle has published a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities but does not explicitly confirm a patch for this CVE in the provided advisory content.

Successful exploitation can lead to unauthorized access to critical or all accessible data within PeopleSoft Enterprise CS Campus Community and unauthorized modification of some data. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability. The vulnerability requires network access but no authentication, making it a significant risk if exploited despite the high complexity to do so.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until an official patch is confirmed and applied, monitor Oracle advisories for updates. No vendor advisory states that no action is required or that the issue is already mitigated.