This vulnerability affects Oracle PeopleSoft Enterprise CS Campus Community version 9.2.38 and involves a security component flaw that permits unauthenticated remote attackers to gain unauthorized creation, deletion, modification, or read access to data accessible by the product. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm a patch or remediation level for this specific issue. Customers are advised to review the advisory and apply patches as they become available.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data within PeopleSoft Enterprise CS Campus Community, as well as unauthorized read access to some accessible data. This compromises data integrity and confidentiality to varying degrees but does not affect availability. The vulnerability requires network access via HTTP and is difficult to exploit due to high attack complexity. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends customers remain on actively-supported versions and apply security patches promptly when they are released. Until a patch is confirmed and applied, consider restricting network access to the affected service where feasible.