This vulnerability affects Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 in the Security component. It requires an attacker to have physical access to the communication segment attached to the hardware where the product executes. The vulnerability allows unauthorized access to critical data and limited unauthorized data modification (update, insert, or delete). The CVSS vector indicates the attack vector is adjacent network (AV:A), with high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), low integrity impact (I:L), and no availability impact (A:N). There is no explicit vendor advisory stating a patch or fix for this specific vulnerability, but Oracle's July 2026 Critical Patch Update advisory references multiple patches and strongly recommends applying patches promptly. No known exploits in the wild have been reported.

An attacker with physical access to the network segment connected to the affected hardware can gain unauthorized access to critical data and perform unauthorized updates, inserts, or deletes on some accessible data within PeopleSoft Enterprise CS Campus Community 9.2.38. This compromises confidentiality significantly and integrity to a lesser extent, but does not affect availability.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly. However, no specific patch or remediation level is explicitly stated for this vulnerability in the advisory content provided. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Until a patch is applied, restrict physical access to the communication segments attached to the hardware running the affected software to mitigate exploitation risk.